The Poisoned Tool Was Already Inside the Prompt

Model Context Protocol tool metadata enters an agent's working context, giving an untrusted tool provider a place to hide instructions before the user asks for anything. This study tests that path with real execution rather than model answers alone. Its mcpvenom harness spans 12 frameworks, 18 models and 45 attack scenarios, producing 9,720 framework-model-scenario cells. The authors report an overall attack success rate of 22.9 percent: among those 2,113 vulnerable cells, 64.9 percent dispatched the attacker-controlled tool, 23 percent reached the attacker endpoint and 12.1 percent produced verified canary-secret exfiltration. Nine core frameworks clustered between 23 and 26 percent, while model attack rates ranged from 0.4 to 49.7 percent. A regular-expression metadata scanner blocked 20 of 45 scenarios but also produced a 7.2 percent false-positive rate. These are controlled study results and a code audit, not proof that every MCP deployment or named model is compromised.