The attack is dangerous because the tool may look normal. A calendar connector or MCP server can include a description that tells the model to reveal data, change its goal, or call another tool. The model does not reliably distinguish those instructions from valid guidance.
Where can tool poisoning enter an agent?
It can enter through discovery, descriptions, returned content, or a compromised dependency. A malicious tool can seek extra access, disguise an operation, or redirect the next step. Every tool description and result is untrusted input to the model, even when the tool itself is allowed.
Tool poisoning is a form of prompt injection that exploits the path from language to action. Allowlisting a tool name does not make its metadata trustworthy.
How should a team contain it?
Approve tool servers before registration, review their capabilities and metadata, and give each one the smallest credential it needs. Validate tool calls against strict schemas, then enforce agent authorization outside the model. A poisoned response should never gain access by default.
AI agent security testing should include a tool with harmful hidden guidance. The test passes only if the tool call is denied or paused before external state changes.