First reported · updated · 6 reports thehackernews.com
Analysis · latest
First reported · updated · 4 reports nhimg.org
MCP's Broken Trust Model: Tool Poisoning, Rug Pulls, and the New Threat Landscape
An analysis of the Model Context Protocol's (MCP) trust model examines tool poisoning, rug pulls, and other attack paths where malicious instructions embedded in tool metadata can subvert AI agents. Drawing on NSA MCP guidance, an arXiv STRIDE/DREAD threat-modeling paper, OWASP, and Invariant Labs research, it argues that MCP implementations frequently skip authentication and re-authorization, letting approved agents reach sensitive resources without review. Details →First reported · updated · 4 reports cybersecpentesting.com
Tool call poisoning in agentic AI: A technical guide to attack mechanics and defenses
A technical guide explains MCP tool poisoning, an indirect prompt injection attack in which a malicious Model Context Protocol server hides instructions in tool metadata (such as the tool's description field) so that when an AI agent calls the tool, injected instructions enter the LLM context and are treated as trusted input, enabling restricted tool calls, data leakage, or system-prompt bypass. The guide draws on an arXiv STRIDE/DREAD threat model that found tool poisoning to be the most impactful client-side MCP vulnerability across seven major MCP clients, and proposes multi-layered defenses including static metadata analysis, decision-path tracking, behavioral anomaly detection, and user transparency. Details →First reported · updated · 4 reports deepinspect.ai
MCP Server Security: How Malicious Tools Attack AI Agents | Precursor Security
An analysis of Model Context Protocol (MCP) server security synthesizes research showing publicly exposed, unauthenticated MCP servers nearly tripled from 492 (July 2025) to 1,467 (April 2026) per Trend Micro, that 33% of scanned servers carry critical vulnerabilities (Enkrypt AI), that static long-lived secrets dominate authentication (Astrix), and that 24,008 secrets leaked in MCP config files (GitGuardian). It frames these exposures against attack classes such as tool poisoning, credential theft via prompt injection, lateral movement, and full cloud compromise, referencing the OWASP MCP Top 10. Details →First reported dev.to
How I vet MCP servers before trusting them in my agent
A practitioner explainer describes how MCP tool descriptions, names, and input schemas are injected directly into an agent's context and are read by the model as instructions, enabling indirect prompt injection such as a tool description that tells the agent to email the conversation to an outside address. The author outlines four vetting checks: scanning tool descriptions and schemas for injection, scanning every tool result, watching tool arguments, and enforcing tenant isolation. Details →First reported silentrobots.com
MCP list caching and tool poisoning
An analysis of MCP tool poisoning explains how a malicious or compromised MCP server can change a tool's description after the user has approved it, embedding hidden instructions the model follows while the UI still shows the friendly approved name. The piece discusses how the 2026-07-28 MCP spec's new cacheable list fields (ttlMs and cacheScope) could blunt sudden catalog swaps and recommends clients hash approved catalogs, honor TTLs, show full descriptions, and pin versions. Details →First reported simonwillison.net
The lethal trifecta for AI agents: private data, untrusted content, and external communication
Nexius Labs' concept guide on Human Control and Mission Control frames AI agent governance around the 'lethal trifecta' — access to private data, exposure to untrusted content, and external communication — and describes attack classes like prompt injection and tool poisoning. Building on Simon Willison's original lethal-trifecta framework, it prescribes controls such as agent identity, evidence logging, risk-based human approval, capability constraints, and treating external content as evidence rather than authority. Details →First reported medium.com
MCP Security: Tool Poisoning, Line Jumping & Rug Pulls ...
An explainer article on MCP security walks through tool poisoning (malicious orders hidden in tool metadata that can exfiltrate credentials while returning correct answers), line jumping (context poisoning at connection time), and rug pulls (an approved server swapping in a malicious description later). It recommends treating MCP servers like dependencies by pinning them by version and content hash, defaulting to read-only, and requiring re-approval after changes. Details →First reported owasp.org
MCP Security - OWASP Cheat Sheet Series
The OWASP MCP Security Cheat Sheet catalogs the attack surface introduced by Anthropic's Model Context Protocol, which lets LLM agents dynamically invoke external tools. It enumerates key risk classes—tool poisoning, rug pull attacks, tool shadowing/cross-origin escalation, confused deputy, data exfiltration via legitimate channels, over-scoped tokens, supply chain attacks, message tampering/replay, and sandbox escapes—alongside best practices such as least privilege and scoped per-server credentials. Details →First reported · updated · 3 reports medium.com
Your AI Agent Trusts Every Tool It's Ever Been Introduced To
An analysis piece, 'The MCP paradox,' argues that the Model Context Protocol standardized not only how agents reach tools but also how attackers reach agents, walking through concrete vectors like tool poisoning attacks where a malicious tool description instructs an agent to exfiltrate secrets (e.g. SSH keys) via text the user never sees. The article cites Invariant Labs' April 2025 tool-poisoning proof of concept and MCP's own design choices, and proposes defensive controls to harden MCP servers. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector