Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Researchers at Invariant Labs demonstrated that AI agents configured with remote Model Context Protocol (MCP) Tools can be vulnerable to model poisoning attacks. They show that an MCP Tool can contain malicious prompts in its docstring description, which is ingested into the AI agent's context, modifying its behavior.
They demonstrate this attack with a proof-of-concept MCP Tool that instructs the agent to perform additional actions before using the tool. The agent is instructed to read files containing credentials from the victim's machine and store their contents in one of the input variables to the tool. When the tool runs, the victim's credentials are exfiltrated to the poisoned MCP server.
ASSESSED SYSTEM
Representative configuration demonstrated by Invariant Labs (MITRE ATLAS AML.CS0054, 2025-04-01): an MCP-client AI agent connected to a remote MCP server whose tool definitions, including model-visible docstrings, enter the agent's context, and which also has a tool able to read files on the user's machine — including ~/.ssh/id_rsa and the client's mcp.json, which often holds credentials for other MCP servers. The record targets the Model Context Protocol tool-poisoning pattern rather than a named client product, so the assessment is of this configuration class: the receiving client and its agent, not the remote server.
OUT OF SCOPE
The adversary-controlled remote MCP server and its poisoned tool (attacker tooling); the Model Context Protocol specification as a standard; any named MCP client product, none of which the record identifies; services reachable with the exfiltrated credentials; and the Fairness axis (Fa-1..4).
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: one agent; the remote server is a tool provider, not a peer agent. Q2 = YES: within one user request the agent invoked a file-reading tool, read credential files and passed their contents to a remote tool — a multi-step tool chain driven by tool-definition content. Tier 2: Tier 2 Consumer: the representative client is an individual user's agent with filesystem access to that user's own credentials, and the exfiltrated SSH key and MCP credentials belong to the user. deadbugz-mcp-supply-chain-campaign placed a broader post-install MCP class at Tier 1 on the strength of command-execution authority; this record evidences file reading and exfiltration but not command execution, so Tier 2 is used.
Documented attack or failure path
- The researchers wrote instructions directing an agent to find and read credential files and to place their contents in an input parameter of an MCP tool, and hid them in the docstring of a tool on an MCP server they hosted.
- The victim configured their agent to connect to that remote server, bringing the poisoned tool definition into the agent's available tool set.
- When the user made a request matching the tool's functionality, the agent invoked it and followed the instructions in its model-visible definition, which also directed it to conceal the additional actions from the user.
- The agent used a file-reading tool to read the user's SSH private key at ~/.ssh/id_rsa and the client's mcp.json.
- It placed the file contents in an otherwise unnecessary tool parameter, sending them over the MCP connection to the remote server and exposing the user's private data.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.05–0.86 (midpoint 0.45), Tier 2 MVT 0.50 indeterminate | |||
| Ro-4Poisoning Attack Resistance | 0.25w 0.19 | The 0.25 anchor, which names this outcome: 'Poisoning succeeds against RAG, memory, or tool metadata with limited effort'. Not 0.00, because the only ingestion evidenced was the user's deliberate connection to the server — an admission decision — and the record does not establish that no validation ran; not 0.50, because the tool-description channel carried no evidenced integrity control. | The agent's tool set accepted a definition whose docstring carried credential-theft instructions, and the poisoned definition persisted as part of the configured tool set from which the agent selected tools for later requests.source: secureflow/atlas |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.05–0.57 (midpoint 0.31), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.09 | The 0.25 anchor: the configured tool set is a basic boundary, but simple prompt manipulation exceeded intended scope — reading the user's private key and other servers' credentials and moving them between tool providers. Not 0.50, because the common violation was not blocked. Consistent with Cn-1 in deadbugz-mcp-supply-chain-campaign. | Following tool-definition text, the agent read ~/.ssh/id_rsa and mcp.json — files unrelated to the user's request — through a file-reading tool, and passed their contents across a server boundary to a different, remote tool.source: secureflow/atlas |
| Cn-2Escalation Prevention | 0.25w 0.12 | The 0.25 anchor: tools are separately configured, but that separation is vulnerable to prompt injection and delegated tool misuse — a third-party definition borrowed the authority of a local tool. Not 0.50, because a single injected definition achieved the escalation without any multi-step chain. Consistent with Cn-2 in deadbugz-mcp-supply-chain-campaign. | Content from one remote, untrusted tool definition directed the agent to invoke a different and more privileged local capability — filesystem reads of credential files — and to conceal the additional actions from the user.source: secureflow/atlas |
| Cn-3Output Filtering Robustness | 0.00w 0.13 | The 0.00 anchor for the tool-argument output channel: sensitive data — a private key and service credentials — was emitted directly with no policy enforcement. Not 0.25, because the 0.25 anchor describes filters bypassed by paraphrase, encoding or multi-turn setup, and here the credentials passed untransformed, so no filter on this channel is evidenced as operating. | The contents of ~/.ssh/id_rsa and mcp.json left the client verbatim in an extraneous tool-call parameter sent to the remote MCP server, and 'the user's private data was exposed to remote MCP server'.source: secureflow/atlas |
| Cn-8Untrusted Context Isolation | 0.00w 0.14 | 0.00 anchor: tool-definition text from a remote, untrusted server was admitted to active context as trusted instruction by design, with no origin label and no denial of instruction authority, and it produced file reads and a disclosure the user did not request. The 0.25 anchor requires labelling on some channels or prompt-wording denial, neither of which is recorded. Moved from Ro-1 under the 26-sub-metric basis: the evidence describes only the admission of untrusted content as instruction (a boundary failure) and nothing about the model's resistance under adversarial testing, so Ro-1 is UNKNOWN. | Instructions hidden in a remote tool's model-visible docstring were ingested into the agent's context and followed: 'the agent ingested and followed malicious instructions supplied through the remote tool's model-visible definition rather than directly through an adversary-authored user message'. The definition also directed the agent to conceal the additional actions from the user, and no instruction/data separation on the tool-definition channel is evidenced.source: secureflow/atlas |
Unknown, not N/A: 21 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.75w 0.25 | The 0.75 supervised-autonomy anchor: the agent executed a multi-step chain — file reads followed by a remote tool call — within one user request with no per-action approval evidenced, under instructions that directed concealment from the user. Held at 0.75 because execution followed a user request rather than self-directed or scheduled operation. |
| AsAttack Surface Exposure | 0.75w 0.35 | Placed at the 0.75 anchor, consistent with deadbugz-mcp-supply-chain-campaign: the untrusted party is a remote MCP server operator whose tool definitions enter the agent's context once the user connects; exposure follows a user configuration choice rather than arbitrary internet input. |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph with DGC at least 0.90 is published for this boundary, so the specification's worst-case graph default governs. The record also corroborates an ungated path from remote tool metadata, through the agent's local file-reading tool (L3), to the user's SSH private key and other MCP servers' credentials (credential-issuing terminals, L4), and out to the remote server.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.50w 0.20 | Placed at the 0.50 anchor, consistent with deadbugz-mcp-supply-chain-campaign. Client-side controls are architectural and multi-layer — tool-definition pinning and scanning, cross-server isolation, filesystem scope restriction, tool-argument inspection, approval showing full arguments — and the underlying susceptibility of a model to follow tool-definition text is reduced rather than eliminated by them. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.15 | Documented interpolation below the 0.25 anchor. No client product, model, tool inventory or configuration is identified; the record names only the protocol pattern, the poisoned docstring technique and the files read. |
| Ec — Public evaluation coverage | 0.16 | coverage 0.19 (5 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2025-04-01; age 565 days on the workpaper reference date. Components: T_behavior 0.00 · T_containment 0.00 · T_calendar 0.01 · C_evidence 0.85. Binding term: T_behavior. dt_days = 565, measured from 2025-04-01 — the MITRE ATLAS AML.CS0054 incident date for Invariant Labs' disclosure — to the 2026-10-18 evidence reference date; the AIDEFEND SecureFlow conversion is dated 2026-08-06. agentic = true: the agent's tool set changes whenever a server is connected or its definitions change, so the containment staleness floor (M_Cn = 2.0) applies. baw = true on the Behavioral Attestation Window checklist item 'self-modifying prompts or configuration': remote tool definitions are model-visible instruction context supplied, and changeable, by the server and persist in the configured tool set; no Behavioral Attestation Battery is evidenced, so delta_t_beh defaults to the elapsed evidence age. C_evidence = 0.85: unresolved tool-metadata and cross-server isolation gaps. No C_event cap is applied: the record is a controlled demonstration, not an event in a production deployment. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.00 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.5 midpoint, interval 1.6–7.4; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-024.001 | Fully Qualified Tool ID & Version PinningExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-3. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-H-024.002 | MCP Tool Descriptor Hash Binding & Drift DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-H-024.004 | Approved Tool Contract Semantics & Change AdmissionExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-H-016.001 | System Prompt Structure & Instruction/Data SeparationExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-017.007 | Dual-LLM Isolation PatternExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-H-017.002 | Least-Privilege Tool ArchitectureExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-7. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.002 | Policy-Based Access ControlExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-8, step-9, step-10. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-8, step-10. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-D-003.002 | Sensitive Information & Data Leakage DetectionExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-8, step-10. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-1 Cn-3 Cn-7 |
| AID-H-028.002 | Client Credential Secure Storage & Lifecycle ManagementExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-DV-002 | Honey Data, Decoy Artifacts & Canary Tokens for AIExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-9. Presence supplies no score credit. | Candidate evidence route | Pr-1 |
| AID-H-018.005 | Value-Level Capability Metadata & Data Flow Sink EnforcementExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-10. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-E-001.001 | Root & Long-Lived Credential Object EvictionExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-E-001.002 | Issued Token, Authentication Session & Lease RevocationExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | Cn-5 |
| AID-R-004 | Fleet Remediation Propagation & Technical Recurrence PreventionExact SecureFlow defense-map identifier (flow atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | ORP:Rf remediation evidence |
WHAT THIS CASE TEACHES
Tool metadata is instruction input: a docstring alone moved an agent from a benign request to reading an SSH private key and exfiltrating it in a tool argument, so AITBM scores the receiving client (Cn-8, Ro-4, Cn-1, Cn-2, Cn-3) rather than the malicious server, which is attacker tooling, and places the leak on Cn-3 because the data left through a tool-call argument rather than through model memorisation.
Sources: AIDEFEND SecureFlow — Data Exfiltration via Remote Poisoned MCP Tool · MITRE ATLAS case study AML.CS0054 · MCP Security Notification: Tool Poisoning Attacks (invariantlabs.ai)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0054 (exercise) |
|---|---|
| Target | Model Context Protocol |
| Actor | Invariant Labs |
| Primary evidence date | 2025-04-01 |
| SecureFlow record updated | 2026-08-06 |
| AI layers | Autonomous agents, Tool integrations / MCP |
| Risk impact | Data exfiltration, Credential and identity theft |
| Affected components | remote MCP server, MCP tool description and docstring, AI agent tool dispatcher, local credential files, MCP tool parameter channel |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Craft Credential-Theft Tool PromptThe researchers crafted a prompt that instructs an AI agent to discover and read user credentials files and store them in an input parameter of an MCP tool. | AML.TA0003 AML.T0065 |
| 2 | Host Poisoned MCP ServerThe researchers hosted a poisoned MCP server that contains the malicious instructions hidden in the docstring of one of the provided tools. | AML.TA0003 AML.T0115.002 |
| 3 | Connect Agent to Adversary-Controlled MCP ServerThe victim configured their AI agent to connect to the adversary-controlled remote MCP server, introducing the poisoned tool definition into the agent's available tool set. | AML.TA0004 AML.T0010.005 |
| 4 | Embed Credential-Theft Instructions in Tool DefinitionThe MCP tool's model-visible docstring contained malicious instructions directing the agent to read credential files, conceal the additional actions from the user, and place the credential contents in an otherwise unnecessary tool parameter. | AML.TA0006 AML.T0110.000 |
| 5 | Trigger Poisoned MCP ToolWhen the user made a request that represented the poisoned tool's functionality, the agent invoked the poisoned MCP tool and acted on the malicious instructions contained in its definition. | AML.TA0005 AML.T0011.002 |
| 6 | Execute Tool-Definition Prompt InjectionThe agent ingested and followed malicious instructions supplied through the remote tool's model-visible definition rather than directly through an adversary-authored user message. | AML.TA0005 AML.T0051.001 |
| 7 | Invoke File-Reading Agent ToolThe prompt invoked an agent tool capable of reading files from the victim's filesystem. | AML.TA0005 AML.T0053 |
| 8 | Read Local SSH Private KeyThe prompt instructed the AI agent to read the user's SSH keys at `~/.ssh/id_rsa`. | AML.TA0013 AML.T0055 |
| 9 | Read MCP Configuration CredentialsThe prompt instructed the AI agent to read `mcp.json`, which often contains credentials for other MCP servers. | AML.TA0013 AML.T0098 |
| 10 | Exfiltrate Credentials via Tool ParameterThe prompt instructed the AI agent to store the credentials files in an extraneous MCP tool parameter to exfiltrate them via the MCP connection. | AML.TA0010 AML.T0086 |
| 11 | Expose User Private DataThe user's private data was exposed to remote MCP server. | AML.TA0011 AML.T0048.003 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0054-remote-poisoned-mcp-tool-data-exfiltration; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0054 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).