3 ms·
The Tool Poisoning attack seems like any other example of installing software you didn’t write yourself. There could be malicious instructions in any program.
by JSR_FDED 2y ago
The Tool Poisoning attack seems like any other example of installing software you didn’t write yourself. There could be malicious instructions in any program.
- simonw 2y agoThat's why I added the section pointing out that even without installing a malicious server you may run into problems with malicious instructions: https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/#mixing-tools-with-untrusted-instructions-is-inherently-dangerous https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/#m...
- distantranges 2y agoI am curious how is your example add function that allows an LLM to read files or environment variables and send the stolen data to another server is different from data exfiltration supply chain attack? To me it looks like that this type of attack isn't inherent to LLM-based applications.
- lbeurerkellner 2y agoWe recently updated our post on WhatsApp tool poisoning, to include an attack setup that does not require a malicious MCP server. It suffices to send you an injected message. See: https://invariantlabs.ai/blog/whatsapp-mcp-exploited#experiment-2 https://invariantlabs.ai/blog/whatsapp-mcp-exploited#experim...