MCP Tool Poisoning and Rug Pulls: When the Agent's Tools Become the Attacker
Invariant Labs' April 2025 disclosure showed that Model Context Protocol tool descriptions, which the model reads but the user rarely sees in full, can carry hidden instructions, and that a server can change those descriptions after approval.
6 min read↗