← All Terms

Tool Poisoning

An attack that hides instructions in the description of a tool an AI model can call, so the model follows them without the user seeing them.

Agentic AI

When an AI agent connects to a tool, for example through an MCP server, it reads a description of what the tool does and how to call it. Tool poisoning places hidden instructions in that description. The model sees the full text; the user usually sees a short summary. Invariant Labs demonstrated the attack in April 2025 with a simple “add” tool whose description told the model to read SSH keys and configuration files and pass them out through the tool’s parameters.

A related variant is the “rug pull”: a server behaves normally until it has been approved, then changes its tool descriptions. Because approval happened once, the change goes unnoticed unless someone is watching for it.

Treat tool descriptions as code. Pin connector versions, review updates before they load, alert when a description changes, and limit what any tool call can reach, so that a poisoned description has little to work with.

Read more on this
Governance & Risk

Why the AI Model Is the Weakest Link in Your Supply Chain

Most organisations have spent years hardening their software, cloud and vendor supply chains. AI adds a dependency those programmes were not built for: the model, and the training data, fine-tunes, retrieval corpus and tools that shape what it does. It is probabilistic, hard to inspect and usually sourced from outside. Here is where the model supply chain breaks, what the public record shows, and how to design integrity, provenance and behavioural limits to the same standard as the rest of the chain.