Attacks in tool text work in 22.9% of 9,720 AI agent tests

Researchers examined tool poisoning in 12 agent frameworks, 18 models and 45 attack scenarios, 9,720 tests in all. An attacker puts hidden instructions in the text or data that an external tool gives to a model. The attack success rate is 22.9%. In 12.1% of the tests with a success, the system sent a secret to the attacker.

How it works

The open source tool mcpvenom operates the tool calls, and does not only check text. MCP, the Model Context Protocol, is a standard that connects agents to external tools. A test counts as theft when a test secret gets to the server of the attacker.

The numbers

In the tests with a success:

• 64.9% sent a tool call of the attacker.
• 23.0% got to the external address of the attacker.
• 12.1% sent a secret to the attacker.

The result is almost the same in 9 frameworks.

What is not known

A scanner for the text of tools stopped 20 of 45 scenarios, and it also stopped some safe tools. The authors tell that the vendors rejected all their reports.

Insight: Framework vendors put protection on model vendors

In October 2026, researchers made 6 agent frameworks operate a tool call from an attacker. This test finds planned protection in none of 12 frameworks, and the vendors rejected all reports. This reads as a move by framework vendors to put the protection on model vendors. The model that you select is then your primary protection. Add an approval check external to the model.