{
  "$schema": "https://themachinepress.com/schemas/story-v1.schema.json",
  "schema_version": "1.0.0",
  "document_type": "machine_press_story",
  "story": {
    "story_id": "mp-2026-11-03-001",
    "source_story_id": "tmp-lead-mcp-tool-poisoning",
    "edition_id": "mp-2026-11-03-morning-0116",
    "edition_url": "https://themachinepress.com/edition/2026-11-03",
    "position": 1,
    "story_type": "lead",
    "section": "safety-security",
    "editorial_classification": "editorial",
    "headline": "The Poisoned Tool Was Already Inside the Prompt",
    "slug": "the-poisoned-tool-was-already-inside-the-prompt",
    "dek": "A 9,720-cell study found real tool-poisoning success in 22.9 percent of framework-model-scenario combinations—and verified secret exfiltration in 12.1 percent of those successful attacks.",
    "summary": "A 9,720-cell study found real tool-poisoning success in 22.9 percent of framework-model-scenario combinations—and verified secret exfiltration in 12.1 percent of those successful attacks.",
    "body_text": "Model Context Protocol tool metadata enters an agent's working context, giving an untrusted tool provider a place to hide instructions before the user asks for anything. This study tests that path with real execution rather than model answers alone. Its mcpvenom harness spans 12 frameworks, 18 models and 45 attack scenarios, producing 9,720 framework-model-scenario cells. The authors report an overall attack success rate of 22.9 percent: among those 2,113 vulnerable cells, 64.9 percent dispatched the attacker-controlled tool, 23 percent reached the attacker endpoint and 12.1 percent produced verified canary-secret exfiltration. Nine core frameworks clustered between 23 and 26 percent, while model attack rates ranged from 0.4 to 49.7 percent. A regular-expression metadata scanner blocked 20 of 45 scenarios but also produced a 7.2 percent false-positive rate. These are controlled study results and a code audit, not proof that every MCP deployment or named model is compromised.",
    "why_it_matters": "A 9,720-cell study found real tool-poisoning success in 22.9 percent of framework-model-scenario combinations—and verified secret exfiltration in 12.1 percent of those successful attacks.",
    "limitations": [
      "These are controlled study results and a code audit, not proof that every MCP deployment or named model is compromised."
    ],
    "importance": 10,
    "canonical_url": "https://themachinepress.com/story/mp-2026-11-03-001/the-poisoned-tool-was-already-inside-the-prompt",
    "json_url": "https://themachinepress.com/story/mp-2026-11-03-001.json",
    "first_published_at": "2026-11-03T09:00:00.000-05:00",
    "modified_at": "2026-11-03T09:00:00.000-05:00",
    "content_status": "new",
    "is_carryover": false,
    "carryover_reason": null,
    "key_claims": [
      {
        "claim_id": "claim-mp-2026-11-03-001-001",
        "text": "A 9,720-cell study found real tool-poisoning success in 22.9 percent of framework-model-scenario combinations—and verified secret exfiltration in 12.1 percent of those successful attacks.",
        "source_ids": [
          "source-2026-11-03-001"
        ],
        "qualification": "These are controlled study results and a code audit, not proof that every MCP deployment or named model is compromised."
      }
    ],
    "source_ids": [
      "source-2026-11-03-001"
    ],
    "tags": [
      "MCP",
      "tool poisoning",
      "agent security",
      "exfiltration"
    ],
    "image_url": "https://themachinepress.com/issues/2026-11-03/lead-mcp-tool-poisoning.png",
    "corrections": []
  },
  "sources": [
    {
      "source_id": "source-2026-11-03-001",
      "title": "arXiv preprint 2611.03555, original v1",
      "publisher": "arXiv",
      "url": "https://arxiv.org/abs/2611.03555v1",
      "canonical_url": "https://arxiv.org/abs/2611.03555v1",
      "source_type": "primary_research",
      "is_primary_source": true,
      "published_at": "2026-11-02T13:17:08.000-05:00",
      "accessed_at": "2026-11-03T08:18:17.000-05:00",
      "supports_claim_ids": [
        "claim-mp-2026-11-03-001-001"
      ]
    }
  ],
  "corrections": [],
  "publisher": {
    "name": "The Machine Press",
    "url": "https://themachinepress.com",
    "description": "A daily newspaper for the age of artificial intelligence."
  },
  "cite_this_report": {
    "title": "The Poisoned Tool Was Already Inside the Prompt",
    "publisher": "The Machine Press",
    "published_at": "2026-11-03T09:00:00.000-05:00",
    "canonical_url": "https://themachinepress.com/story/mp-2026-11-03-001/the-poisoned-tool-was-already-inside-the-prompt"
  }
}