MCP tool poisoning: hidden instructions in tool descriptions hijack AI agents

Invariant Labs demonstrated in April 2025 that hidden instructions embedded in MCP tool descriptions can make AI agents read and exfiltrate files like /etc/passwd without any exploit. A 2025 study found 38–41% of registered MCP servers have no authentication, and OWASP lists the threat as MCP03: Tool Poisoning in its MCP Top 10.

• No exploit needed: malicious instructions hide in an MCP tool's description field
• 38–41% of registered MCP servers have no authentication at all
• CVE-2025-6514 in mcp-remote: CVSS 9.6, 437,000+ downloads before disclosure
• OWASP MCP Top 10 classifies the threat as MCP03: Tool Poisoning