Poisoned Tool Description

Poisoned tool description occurs when a connected tool’s description, metadata, schema, or usage instructions contain hidden or adversarial instructions that influence the synthetic subject. These instructions may be visible to the model during tool selection but hidden, truncated, or unclear to the human reviewer.

This configuration creates an elevated exposure condition because tool descriptions are not passive documentation. They may enter the model’s context and affect which tool is selected, what data is passed to it, and how the synthetic subject behaves before or after the call.

The primary risk is metadata-driven manipulation. A synthetic subject may disclose secrets, call unsafe tools, pass sensitive data, or perform unauthorized actions because the tool description instructs it to do so.

Investigators should review tool descriptions, metadata, schemas, client display behavior, hidden text, encoded content, prompt-like language, and tool-call logs. Particular attention should be given to descriptions containing instructions to ignore rules, access sensitive files, forward data, or prefer one tool over another.

Investigative Relevance

Poisoned tool descriptions are relevant because the attack surface may sit in tool metadata rather than user prompts or tool code. This sub-section is especially relevant where tools are installed from marketplaces, open registries, third-party repositories, or MCP servers managed outside the organization.