MCP solved a real problem — connecting AI agents to tools in a standardized way. It also opened up an attack surface almost nobody is auditing yet, and the numbers confirm it.
Tool poisoning happens when tool descriptions, retrieved content, or metadata are poisoned or manipulated to steer the model toward unsafe tool calls or unauthorized data access. A malicious or compromised MCP server hides instructions inside a tool's description or metadata; the model reads and follows them, while the user only sees an innocent-looking label — the attack lives in a layer the human user normally never inspects.
A confused deputy attack occurs when a system with elevated privileges is manipulated into using those privileges on behalf of someone who shouldn't have them. In the MCP context: an agent with access to sensitive tools is tricked into calling them in ways its deployer never intended — the MCP server executes actions using its own privileges instead of the real user's, which can grant access to resources that user should never be able to touch.
A 2025 academic study found tool poisoning in roughly 5.5% of a sample of 1,899 MCP servers. A more recent AgentSeal scan of 1,808 servers reported that 66% had at least one security finding. Attack classes already documented in 2025-2026 include tool poisoning, "rug pulls" (a server changes behavior after gaining trust), tool shadowing, cross-server attacks, confused-deputy/OAuth weaknesses, prompt injection, and what's known as the "lethal trifecta."
Recommendations already solidifying as best practice: gate the list of available tools behind a human approval step before enabling them in a production agent, show the user the full tool call instead of a friendly summary that could hide what's actually happening, and keep sensitive MCP servers isolated from general-purpose servers — so a poisoned tool on an untrusted server can't reach critical systems without crossing an additional barrier.
If you built your own MCP server (as we covered in our FastMCP guide), the responsibility for making sure your tools' descriptions can't be manipulated falls on you. If you consume third-party MCP servers — increasingly common via Claude's connectors directory, which already lists more than 950 — treat every new server as unaudited third-party code until you confirm otherwise, exactly as you'd treat an unfamiliar npm or pip dependency.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel