Invariant Labs demonstrates MCP tool poisoning: hidden instructions in tool descriptions exfiltrate data from AI agents
Invariant Labs (proof of concept) · Apr 7, 2025 · Coding agent
What happened
Invariant Labs published a proof-of-concept 'tool poisoning attack' against the Model Context Protocol: a malicious MCP server embeds hidden instructions inside a tool's description field — invisible in the host UI — which the connected agent obeys. In demonstrations, agents connected to the poisoned server read local files and private data and sent them to an attacker-controlled server; the same technique was shown exfiltrating WhatsApp chat histories.
Causal vector
Hidden prompt injection in MCP tool metadata (description/arguments fields) — instructions the model sees but the human operator does not
Source
Reported by Invariant Labs. Verified against the primary report.
Tool poisoning defeats human review because the poisoned instructions never render in the UI — the model acts on text only it can see. The defence is not better prompts: it is an egress policy that BLOCKS outbound calls to any destination not on an approved allowlist, so even an obedient-to-attacker agent cannot ship data out.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
OpenAI Codex escalates to root by exploiting Docker group membership to overwrite a system config
OpenAI (Codex) · May 1, 2026
Study: best AI agents complete only ~2% of 240 real Upwork projects
Upwork / academic study · Nov 1, 2025
GitHub Copilot prompt injection enables remote code execution (CVE-2025-53773)
GitHub (Copilot / VS Code) · Aug 12, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.