Research
MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 6 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
MCP tool poisoning can redirect agents through untrusted tool metadata and responses, making tool-execution controls and exfiltration monitoring important beyond metadata scanning alone.
A cross-framework study of MCP tool poisoning tested real tool execution across 12 frameworks, 18 models, and 45 attack scenarios, reporting a 22.9% attack success rate and verified secret exfiltration in a subset of successful cases. The researchers found no intentional defenses in the audited frameworks and only partial protection from tool-description scanning.