Apr 7, 2025Confirmed
Invariant Labs shows MCP tool poisoning can make AI agents leak files and chat histories
AI loose in the worldDERIVED
Approved by person, Oct 11, 2026. How entries are approved
Invariant Labs published a proof-of-concept attack on the Model Context Protocol. A malicious server hides instructions in a tool's description, which the user interface does not show. In demonstrations, connected agents read local files and private data and sent them to an attacker's server, including WhatsApp chat histories.
What this means for youAI assistants that connect to outside tools can be tricked by instructions you cannot see. Before adding a tool or server to an AI assistant, use only ones from sources you trust and limit which files and accounts it can reach.
Sources
- Invariant Labshttps://www.invariantlabs.ai/blog/mcp-tool-poisoning
- Cloud Security Alliancehttps://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-tool-poisoning-ai-agent-exfiltration-2/
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2371. It has not been edited since it was approved; the hash above would not match if it had. How to verify