What is Tool Poisoning?
Tool poisoning is an attack in which the descriptions, schemas, or metadata that tell an AI agent how to use a tool are altered to contain hidden instructions. Because the agent reads these definitions as trusted configuration, malicious text placed there can influence its behavior without ever appearing in a user message. It is a supply chain variant of prompt injection.
The mechanism relies on a boundary that is often overlooked. An agent's context typically concatenates system instructions, user messages, retrieved content, and tool definitions into one stream that the model interprets uniformly. Any channel that reaches that stream is an instruction channel, and tool definitions supplied by a third party server or registry are exactly such a channel.
Attacks of this type are attractive because tool definitions are rarely reviewed after the initial integration, may be fetched dynamically at connection time, and can change quietly after approval. A definition can also refer to other connected tools, which allows one component to shadow or influence how another is invoked, so the exposure is not limited to the tool that was modified.
Defense starts with treating every tool definition as untrusted input. Pin and version definitions, review their full text at integration time, alert on any change, and prefer servers and registries with verifiable provenance. Render definitions to human reviewers exactly as the model receives them, including fields that user interfaces normally hide, since concealment is what makes the technique effective.
Runtime controls limit the consequences when prevention fails. Scoped credentials, least privilege on every tool, explicit approval for actions that write data or spend money, egress restrictions that prevent sending data to arbitrary destinations, sandboxed execution, and a complete audit trail all reduce the blast radius. Monitoring for tool calls that do not follow from the user's request provides detection.
Key points
- Hidden instructions planted in tool descriptions or schemas.
- Exploits the model treating tool metadata as trusted.
- Definitions can change after approval, so pin and monitor them.
- Review the full definition text the model actually receives.
- Limit damage with least privilege, approvals, and egress control.
In practice
An agent connects to an external tool server that offers a currency conversion function. Its definition carries text beyond the short summary shown in the interface, and the model reads all of it alongside everything else in context. Because the text arrives as configuration rather than as user input, nobody inspects it. Pinning the definition and comparing it on every update surfaces such changes before use.