Agentic AI tools face widespread vulnerability to poisoning attacks
MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study
Cryptography and SecurityArtificial Intelligence
Summary
Connecting AI language models to external tools can let attackers sneak harmful content into the AI’s context, leading to risks like secret data leaks. The authors studied 12 popular AI frameworks with real attacks and found nearly 23% were vulnerable to such tool poisoning, including leaking secrets. They also found no built-in defenses in these frameworks, although some simple filters helped reduce certain attacks. This highlights a major security issue for AI systems that use external tools without proper checks.
What this means in practice
- •For ai security teams: Assess and mitigate real-world vulnerabilities in AI frameworks that connect language models to external tools, based on a detailed cross-framework measurement.
- •For software developers: Implement and improve tool input validation and metadata scanning in AI integrations to reduce risk of attacker-controlled content execution.
Authors
Farooq Shaikh, Biagio Montaruli
Abstract
The Model Context Protocol (MCP) lets agentic AI frameworks connect language models to external tool providers, but it carries attacker-controlled content (tool descriptions, schema fields, and response data) into model context without validation. Prior benchmarks measure model compliance with poisoned instructions without confirming real execution. We present the first cross-framework measurement of MCP tool poisoning with real tool execution. A 25-class root-cause taxonomy unifies prior classifications, and the open-source tool mcpvenom drives a 9,720-cell susceptibility matrix across 12 frameworks, 18 models, and 45 attack scenarios, with a dual oracle that confirms exfiltration via canary HTTP receipt. The overall attack success rate is 22.9% (2,113 vulnerable cells). Of these, 64.9% dispatch an attacker tool call, 23.0% contact the attacker endpoint, and 12.1% verifiably exfiltrate a secret. Resistance is model-level: nine core frameworks cluster within 23 to 26% (chi-squared = 3.30, p = 0.91), and no framework implements intentional defense. Incidental framework properties mitigate in specific cases, and a regex description scanner rejects 20 of 45 scenarios at a 7.2% false-positive rate, so metadata scanning alone is a partial control. Model ASR ranges from 0.4% to 49.7%. Claude Opus 4.8 is vulnerable in 8 of 530 cells while issuing 223 explicit refusals. A code-level audit finds no intentional defense across twelve frameworks, and all five coordinated disclosures across four vendors were rejected.