MCP Tool Poisoning in Agentic AI Frameworks Across Multiple Frameworks

# MCP Tool Poisoning in Agentic AI Frameworks Across Multiple Frameworks

https://gcdradar.vercel.app/incidents/mcp-tool-poisoning-in-agentic-ai-frameworks-across-multiple · AIR-2026-1731 · live

- Lane: Research
- Severity: 1 (Research / proof of concept): Research paper demonstrating active tool poisoning and execution across Model Context Protocol frameworks.
- Fix status: Fix status unknown
- First reported: 2026-11-03
- AI role: Attack on AI
- Products: Model Context Protocol, mcpvenom

## Summary

Researchers present the first cross-framework measurement of Model Context Protocol (MCP) tool poisoning with real tool execution. Using an open-source tool called mcpvenom, the study demonstrates how untrusted tool descriptions and response data compromise agentic frameworks.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Affected and fixed versions

- Affected: Model Context Protocol frameworks

## Latest updates

- 2026-11-05: Research demonstrates that cryptographically signed Model Context Protocol tools can still conceal malicious code that leaks sensitive data (https://arxiv.org/abs/2611.06585)
- 2026-11-03: MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study (https://arxiv.org/abs/2611.03555)

## Sources

- 2026-11-03 arXiv: MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study https://arxiv.org/abs/2611.03555
- 2026-11-05 arXiv: Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains https://arxiv.org/abs/2611.06585

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.