MCP tool poisoning: 36.5% attack success across 20 models

Hidden instructions in MCP tool descriptions bypass code review: the MCPTox benchmark found poisoned tools succeeded 36.5% of the time on average across 20 models, peaking at 72.8% against one. Nine of 11 public MCP registries accepted poisoned tools with no automated screening. Defences include the free MCP-Scan scanner, version pinning and least privilege.

• MCPTox: 36.5% average attack success, up to 72.8% against one of 20 models
• 9 of 11 MCP registries accepted poisoned tools with zero screening
• Invariant Labs demo exfiltrated an SSH key from a Cursor session
• Free MCP-Scan flags poisoned descriptions and rug-pull swaps