MCP Poisoning

MCP poisoning is an attack where a malicious MCP server embeds hidden instructions inside tool descriptions, resource content, or prompt templates that manipulate a connected AI agent into taking unintended actions. Unlike direct prompt injection, MCP poisoning exploits the trust an agent places in server-provided metadata, making it difficult to detect without schema validation and content filtering at the gateway layer.