MCP Tool Descriptor Poisoning

How the attack unfolds

1. 1. The setup

   The target is a Reactive Agent Architecture. Agents designed for responsive workflows, often event-driven, where actions are taken based on immediate inputs or changes in the environment. Utilizes ReAct paradigm and managed APIs for quick interactions.

2. 2. The attack

   A prompt injection in GitHub's MCP where a malicious public tool hides commands in its metadata; the assistant exfiltrates private repo data.

   Threat T2 · Component KC5 · High

3. 3. Technique: Tool Chain Exploitation

   Chaining multiple tool calls to achieve unauthorized outcomes. The threat catalog rates this T2 vector high.

   Threat T2 · Component KC5 · High

4. 4. Threat: T2 Tool Misuse

   T2 Tool Misuse: Manipulation of tools, APIs, or environment access to perform unintended actions or access unauthorized resources, including exploitation of access to external systems.

   Threat T2 · Component KC6 · High

5. 5. Also in play: T11 Unexpected RCE

   T11 Unexpected RCE and Code Attacks: Tools or environments enabling unexpected code execution, presenting direct risks to code execution environments.

   Threat T11 · Component KC6 · High

6. 6. Why the Reactive pattern is exposed

   The rapid action-taking nature of reactive agents creates risks when tools are invoked quickly without thorough validation. An attacker can exploit the agent's responsiveness to trigger unauthorized tool executions or inject malicious code through event payloads.

   Threat T2 · Component KC5 · High

Threats involved

• T2 Tool Misuse: Manipulation of tools, APIs, or environment access to perform unintended actions or access unauthorized resources, including exploitation of access to external systems.
• T11 Unexpected RCE and Code Attacks: Tools or environments enabling unexpected code execution, presenting direct risks to code execution environments.

Controls that stop it

• M2 Tool Sandboxing & Isolation

  Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.

• M7 Zero Trust & Least Privilege Access

  Implement fine-grained access controls with continuous verification, temporary credentials, minimal permission sets, and dynamic privilege management following zero trust principles to prevent tool misuse, privilege compromise, and unauthorized code execution.

• M13 Secure Development Lifecycle Integration

  Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.

• M6 Comprehensive Security Monitoring & Auditing

  Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.

• M9 Distributed Resource Management & Rate Limiting

  Implement multi-layer resource controls with intelligent quotas, circuit breakers, cost management, and distributed rate limiting to prevent resource exhaustion, financial damage, and denial of service attacks while maintaining system performance.

• M12 Secure Model Training & Validation

  Comprehensive security practices for model training pipelines including data integrity verification, training environment hardening, model validation against adversarial inputs, and ensuring reproducibility of training processes.