MCP Tool Poisoning: Anatomy, Real Attacks, and Defenses
Akto, Thursday, October 15th, 2026
Akto details how malicious MCP tool metadata hijacks AI agents, citing real research, CVEs and defenses.
Akto explains MCP tool poisoning, in which hidden instructions in a tool's metadata hijack an AI agent, citing Invariant Labs research where an innocuous add tool secretly instructed Cursor to read SSH keys and MCP configuration files and exfiltrate them.
The attack works because agents treat tool metadata as trusted instructions rather than untrusted data.
The post covers disclosed CVEs, benchmark results and defense-in-depth strategies.