MCP adoption exploded in Q2 2026 — and so did its attack surface. Tool poisoning is the defining agent security issue of the year. Here is how the attack works and the defense patterns I ship in production repos.
The hottest security topic in agentic AI is not prompt injection in user chat — it is tool poisoning in MCP server metadata. A tool's description lands in the model context as if it were a system instruction. Malicious servers exploit this: hide exfiltration directives in description text, and compliant models execute them. Users see a normal tool call; they never see the poisoned instruction.
Why this is structural, not a bug
Any protocol where third parties supply text that models treat as instructions inherits this risk. MCP tool descriptions, agent skill markdown, ARD catalog entries — all are prompt surface. Patching one server does not fix the class. Enterprise readiness — the top item on MCP's March 2026 roadmap — means audit trails, SSO gateways, and allowlisted server registries, not just more servers in a directory.
- Allowlist MCP servers — never let agents connect to arbitrary registry entries in production
- Per-agent tool partitions — RevOps agents do not inherit BSA/AML database tools (Google ADK Portfolio pattern)
- Trace replay with full argument logging — operators must reconstruct what the model saw
- Output validation before side effects — policy layer approves before money moves or data exfiltrates
- Sandbox iframe execution for MCP Apps — treat UI extensions as untrusted web content
What changes with stateless MCP
The July 2026 stateless spec reduces session-hijack risk but does not eliminate tool poisoning — descriptions remain attacker-controlled. Combine server allowlists with the migration guide in my Trending Loop MCP article. Security and infrastructure are converging topics in 2026 agent deployments.
Frequently asked questions
- What is MCP tool poisoning?
- An attack where a malicious MCP server hides instructions in tool descriptions — text the model receives as trusted context but the user never sees in the UI. Example: a tool description telling the model to read SSH keys and pass them as parameters. Instruction-following models comply.
- How widespread is the problem?
- More than 30 MCP-related CVEs were filed in H1 2026. Tool poisoning became a mainstream concern as MCP crossed 9,400 published servers. The issue is structural — tool descriptions are attacker-controlled prompt injection surface — not a single buggy server.
- How do production teams defend against tool poisoning?
- Allowlist trusted MCP servers, sandbox tool execution, validate tool outputs before acting, use least-privilege tool sets per agent, log full tool call traces for audit, and never grant agents credentials beyond scoped API keys. OPA policy layers (Fraud Agent Orchestrator pattern) gate high-risk actions.