MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study

Summary

Researchers measured MCP tool poisoning across 12 agentic AI frameworks, 18 models, and 45 attack scenarios, using real tool execution and a canary HTTP receipt to confirm exfiltration. The overall attack success rate is 22.9% (2,113 vulnerable cells), with 12.1% verifiably exfiltrating a secret. Resistance is model-level rather than framework-level, and a regex description scanner rejects 20 of 45 scenarios at a 7.2% false-positive rate, so metadata scanning is only a partial control.

Topics

• AI agents
• Model Context Protocol

Related items

• InfoForrester gave Endor Labs the highest score possible in seven criteria, including innovation, AI application flaws, AI SCA, and AI coding toolchain. | Endor LabsSame vendor · Endor Labs Blog
• InfoMonitoring AI agent sessions: Leveraging embedding models to aid threat hunting and attack discovery workflowsSame vendor · Elastic Security Labs
• InfoCrowdStrike's new kill switch can stop rogue AI agents in their tracks, CEO saysSame vendor · CNBC Technology
• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
• HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database