Credential Exfiltration via Remote Poisoned MCP Tool
Model Context Protocol
Researchers demonstrated that AI agents configured with remote Model Context Protocol tools can be manipulated by malicious docstring prompts. The proof-of-concept forced agents to read local credential files and leak them.
- first report
- 31 Mar 2026
- last update
- 31 Mar 2026
Timeline · 2
Sources · 2
News and write-ups
- 2026-03-31MCP Security Notification: Tool Poisoning AttacksInvariant Labs · invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks
Research and catalogues
- 2026-03-31Data Exfiltration via Remote Poisoned MCP ToolMITRE ATLAS · atlas.mitre.org/studies/AML.CS0054
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionAgent hijackData leak
- severity
- 1 · Research / proof of concept
- targets
- Framework / tooling
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM02:2025 Sensitive Information DisclosureLLM06:2025 Excessive Agency
- dates
- happened 1 Apr 2025 · first reported 31 Mar 2026
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Credential Exfiltration via Remote Poisoned MCP Tool https://gcdradar.vercel.app/incidents/credential-exfiltration-via-remote-poisoned-mcp-tool · AIR-2026-0348 · closed 2026-04-14 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2026-03-31 (happened 2025-04-01) - AI role: Attack on AI - Products: Model Context Protocol ## Summary Researchers demonstrated that AI agents configured with remote Model Context Protocol tools can be manipulated by malicious docstring prompts. The proof-of-concept forced agents to read local credential files and leak them. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-03-31: MCP Security Notification: Tool Poisoning Attacks (https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks) - 2026-03-31: Data Exfiltration via Remote Poisoned MCP Tool (https://atlas.mitre.org/studies/AML.CS0054) ## Sources - 2026-03-31 MITRE ATLAS: Data Exfiltration via Remote Poisoned MCP Tool https://atlas.mitre.org/studies/AML.CS0054 - 2026-03-31 Invariant Labs: MCP Security Notification: Tool Poisoning Attacks https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedCursor Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Research · since 24 Jun 2025
AI - closedClaude Code GitHub Action Claude Code GitHub Action Secret Exposure via Prompt Injection
Research · since 5 Jun 2026
AI - closedMCP SDKs Log-To-Leak: Prompt injection attacks on tool-using LLM agents via MCP
Research · since 28 Oct 2026
AI - closedMCP SDKs Cross-modal steganographic prompt injection targeting Model Context Protocol agents
Research · since 26 Oct 2026
AI - closedMicrosoft 365 Copilot EchoLeak Zero-Click Prompt Injection on M365 Copilot
Research · since May 2025 (approx.)
AI - closedLenovo AI Chatbot Lena Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot
Research · since 18 Aug 2025
AI