Threat · curated 20 Jul 2026
One Poisoned MCP Server Can Hijack All the Others — Coograph
First reported · updated · 3 reports appsentinels.ai
Coverage timeline
Why it matters
MCP tool poisoning corrupts an agent's tool registry — its source of truth for what capabilities exist — so a defender's agent can be compromised before any task begins, with no anomalous logs or visible output.
MCP tool poisoning hides malicious instructions inside a Model Context Protocol server's tool descriptions, parameter schemas, or return values — invisible to human reviewers but fully read by the LLM, which then selects and executes the poisoned tool, enabling data exfiltration, credential theft, or lateral movement. The technique spans schema poisoning, tool shadowing, and rug pulls, and is catalogued as OWASP MCP03:2025; a single malicious server can influence an agent's decisions across all connected tools (cross-tool poisoning).
Summary
The article describes 'cross-tool poisoning,' an attack class against AI agents that use the Model Context Protocol (MCP). A malicious MCP server embeds hidden instructions in its tool metadata (description or input schema); when an agent loads its tool list, those instructions hijack the agent into misusing other, trusted MCP servers to read sensitive files or exfiltrate data. The malicious server never touches the data itself—it borrows the permissions of servers already trusted by the user.[0]
The technique is grounded in published proof-of-concept research rather than a specific in-the-wild campaign: Invariant Labs demonstrated both a poisoned calculator tool and a WhatsApp cross-server exfiltration PoC, and Palo Alto Unit 42 documented additional injection vectors through MCP sampling. The core weakness is that MCP assumes connected servers are benign and validates almost nothing, making an agent only as secure as its least-trustworthy connector.[0][3][4]
The piece is also a vendor-authored guidance article (Coograph) that recommends structurally reducing the MCP attack surface and highlights its own read-only, local, open-source code-graph MCP server as an example of a low-risk profile.[0]
Attack chain
- Poisoned tool onboarding: A user wires multiple MCP servers into an AI agent, including one obtained from a marketplace whose tool description contains hidden instructions invisible in typical agent UIs.[0]
- Metadata-based injection: When the agent's LLM loads the tool list, it reads the full tool description/input schema including the buried directive, unlike the human approver who sees only a short benign summary.[0]
- Cross-server hijack: The hidden instruction directs the agent to invoke a separate, legitimate server (e.g., a WhatsApp or Slack connector) to read sensitive data and route it outbound, borrowing the trusted server's permissions.[0]
- Exfiltration through a trusted channel: Data such as .env contents, source code, or message history leaves the environment disguised as normal outbound activity, which logs may record as legitimate.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2025-12-05 | Palo Alto Unit 42 published research on new prompt injection attack vectors through MCP sampling.[4] |
| 2026-06-30 | Coograph published its cross-tool poisoning explainer and guidance article.[0] |
How it works
Each MCP server advertises tools with a name, description, and input schema, all of which the agent's LLM reads to decide what to call. The description field is the attack surface: attackers embed malicious instructions in this metadata rather than in returned data. Because most agent UIs do not display metadata, a human approver sees a harmless summary ('Adds two numbers') while the LLM reads the full text including a hidden directive to read secrets like ~/.ssh/id_rsa.[0][3]
Cross-tool poisoning escalates this: because all connected servers share the same agent context, a poisoned server's description can instruct the agent to act through a different, legitimate server it does not itself have permissions for—demonstrated by Invariant's PoC where a malicious server targeted a separate whatsapp-mcp server to exfiltrate message history to an attacker number.[0][3]
MCP sampling widens the gap: a server can request LLM completions back through the client, allowing it to inject hidden prompts, persist instructions across a session, or covertly invoke tools such as writeFile without the user seeing anything but their expected answer.[0][4]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Model Context Protocol (MCP) ecosystem and agent clients | Clients such as Cursor were found highly susceptible to cross-tool poisoning in independent 2026 testing; Claude Desktop shipped stronger guardrails. The protocol itself validates connected servers minimally. | No specific patch identified; the article recommends structural mitigations rather than a fix.[0] |
Key takeaways
- An AI agent is only as secure as the least-trustworthy MCP server connected to it, because all connected servers share the same context and a poisoned one can act through the permissions of trusted servers.[0]
- The dangerous part of a tool poisoning attack is deliberately hidden in metadata that agent UIs do not show, so 'inspecting harder' fails; risk must be reduced structurally through fewer, read-only, local, open-source, version-pinned servers.[0]
- This is a supply-chain and procurement problem, not just an engineering one: exfiltration through an authorized channel can register as normal activity and become a compliance/breach event.[0]
Defensive actions
- Connect fewer, purpose-scoped MCP servers: Every connected server is a trust decision and a slice of attack surface; keeping the toolset minimal shrinks the blast radius of any poisoned server.[0]
- Prefer read-only, local, and open-source MCP servers: Read-only servers cannot write files or send data and cannot act as an exfiltration channel; local execution keeps code and secrets off third-party clouds; open-source tool descriptions are publicly auditable so hidden instruction blocks have nowhere to hide.[0]
- Pin versions and review tool descriptions and input schemas: Treat MCP servers like dependencies: pinning prevents a server from silently changing its tool descriptions after vetting, and reviewing raw metadata (not just the README) is the only way to catch hidden directives that UIs never display.[0]
- Inventory every connected MCP server and identify which can write or send data: Organizations often cannot name every MCP server wired into their agents; maintaining a manifest of connectors and their write/outbound capabilities is prerequisite to reducing the attack surface.[0]