Agent tool poisoning describes a compromised or manipulated tool surface that changes what an agent is told, what the tool can do, what it returns, or how the agent chooses and executes a downstream action.
GLOSSARY DEFINITION
What Is Agent Tool Poisoning?
Agent tool poisoning is the manipulation of a tool's metadata, configuration, implementation, dependency, output, or behavior so an agent is steered toward an unsafe decision or action.
Working editorial definition. Topic-specific authoritative sources are required before publication.
01Agent tool poisoning describes a compromised or manipulated tool surface that changes what an agent is told, what the tool can do, what it returns, or how the agent chooses and executes a downstream action.verify
02Tool descriptions and metadataverify
03Plugin or skill codeverify
04Dependenciesverify
LEARNING / 01
Agent Tool Poisoning Definition
Tool descriptions and metadata
Plugin or skill code
Dependencies
Configuration
Updates
Returned content
Runtime behavior
Every unsafe tool call
Every prompt injection
Every compromised model
Proof that a specific product detects the behavior
LEARNING / 02
Where the Risk Can Enter
Instructions or metadata may influence when and how the agent selects the tool.
The code behind a tool, plugin, or skill may perform behavior beyond the expected function.
A package or downstream service may change the behavior of an otherwise trusted component.
Endpoints, permissions, environment variables, or defaults may redirect or expand the tool's reach.
A previously reviewed component may change after trust is established.
Tool output may influence later reasoning, tool choice, data access, or actions.
LEARNING / 03
A Typical Tool-Poisoning Path
Content status
This module requires approved source evidence and publication copy before release.
LEARNING / 04
Potential Impact
The agent may choose an unsafe or unintended tool.
The tool may request or receive data outside the expected task.
The workflow may trigger commands, file access, or sensitive writes.
The tool may influence network requests or credential handling.
Returned content may affect later tool calls or decisions.
Actual impact depends on the agent's permissions, host controls, available data, connected systems, and runtime checks.
LEARNING / 05
Tool Poisoning vs Prompt Injection
CriterionPrimary objectA tool surface or behavior, including metadata, code, configuration, dependency, update, or outputInstructions or context that influence model or agent behaviorSystem pathTrust in a component and the actions or content it introducesManipulated instructions entering the model or agent contextPotential overlapA poisoned tool may use injected instructions or return manipulated contentAn injected instruction may direct the agent to misuse a toolReview questionHas the tool surface or behavior changed what the agent can trust or do?Has untrusted instruction content changed the agent's intended behavior?
BoundaryPrompt injection can be one mechanism within a tool-poisoning path, but the two terms are not interchangeable.
LEARNING / 06
How MCP Tool Poisoning Fits the Concept
MCP tool poisoning can be an MCP-specific instance when manipulated tool descriptions, server behavior, configuration, updates, or returned content influence an agent through an MCP connection. Tool poisoning is not limited to MCP.
MCP tool poisoning can be an MCP-specific instance when manipulated tool descriptions, server behavior, configuration, updates, or returned content influence an agent through an MCP connection. Tool poisoning is not limited to MCP.
Who operates the server?
Which tools and descriptions are exposed?
Which permissions and data paths are available?
How are updates reviewed?
Which runtime calls are observable or blockable?
Review MCP & Agent Security
/solutions/mcp-security
LEARNING / 07
What Teams Should Verify
Publisher, source, repository, and package identity
Requested permissions and reachable data
Dependencies, configuration, endpoints, and defaults
Tool descriptions, instructions, and expected behavior
Tool identity, arguments, destination, and requested action
Expected allow, block, flag, or review result
Evidence retained without exposing raw sensitive content
Indirect or unsupported action paths
Version, configuration, permission, dependency, and publisher changes
New or changed tool descriptions and returned content
Re-scan, re-test, exception review, and residual-risk owner
LEARNING / 08
Related AgentGuard Controls
AgentGuard publicly documents Deep Scan for skills, plugins, MCP servers, and agents, including malicious tools and backdoors as named risk categories.
AgentGuard publicly documents Runtime Guard for named high-risk action categories before execution. Whether a specific tool path is covered depends on the integration.
These public facts do not support a claim that AgentGuard detects every poisoned tool, every prompt injection, or every third-party MCP runtime call.
LEARNING / 09
Frequently Asked Questions
What is agent tool poisoning?
It is the manipulation of a tool's metadata, configuration, implementation, dependency, output, or behavior so an agent is steered toward an unsafe decision or action.
How is tool poisoning different from prompt injection?
Prompt injection targets instructions or context. Tool poisoning targets the trusted tool surface or behavior, although prompt injection can be one mechanism within that path.
Is MCP tool poisoning the same concept?
It is an MCP-specific instance when the manipulated tool surface reaches the agent through an MCP server or connection. Tool poisoning is not limited to MCP.
What determines the impact of a poisoned tool?
The agent's permissions, available data, reachable systems, host controls, runtime checks, and the actions the tool can influence.
Can AgentGuard Deep Scan guarantee that a tool is safe?
No. Public evidence supports named component targets and risk categories, not universal detection or a guarantee of safety.
Continue from Concept to Practice
Use the relevant guide, product documentation, and current first-party evidence to verify the next step.