MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study

The Model Context Protocol (MCP) enables agentic AI frameworks to connect language models to external tool providers, yet its design carries attacker-controlled content, spanning tool descriptions, schema fields, and response data, directly into model context without validation. Prior benchmarks measure model compliance with poisoned instructions but stop short of confirming real execution, do not isolate the framework layer’s contribution to defense, and do not document vendor accountability.

We present the first cross-framework measurement of MCP tool poisoning with real tool execution. A 25-class root-cause taxonomy unifies prior classifications (Invariant Labs, MCPTox, OWASP MCP03, MSB, AgentDojo, ETDI, CSA) across all protocol entry points, and an open-source tool (mcpvenom) drives a 9,720-cell susceptibility matrix across 12 frameworks, 18 models, and 45 attack scenarios, with a dual oracle that independently confirms exfiltration via canary HTTP receipt.

The overall attack success rate is 22.9% (2,113 vulnerable cells) across three evidence tiers: dispatched attacker tool call (64.9%), confirmed network contact with the attacker endpoint (23.0%), and verified secret exfiltration (12.1%); verdicts were validated by hand across 1,259 transcripts. All observed resistance is model-level: across the tested configurations, nine core frameworks cluster within 23 to 26% (χ2=3.30, p=0.91), with no framework implementing intentional defense, though incidental framework properties do provide mitigation in specific cases: duplicate-tool-name rejection in Pydantic AI (16.6% ASR) and executor constraints in AG2 (4.6%); a regex scanner implementing the recommended description checks rejects 20 of the 45 scenarios at a 7.2% false-positive rate on 125 benign descriptions, so metadata scanning alone is a partial control. Model ASR ranges from 0.4% (Claude Fable 5) to 49.7% (Amazon Nova Pro), a gap driven by model-level differences across providers. Claude Opus 4.8 is vulnerable in only 8 of 530 cells (1.5%) while issuing 223 explicit refusals that cite the poisoned description. Claude Sonnet 5 exhibits a narrate-then-comply pattern, verbally identifying the attack as a prompt injection before executing the exfiltration call. Code-level audit confirms no intentional tool-poisoning defense across all twelve frameworks, and the five coordinated disclosures we filed across four vendors were all rejected, documenting a structural accountability vacuum in which no layer of the stack claims ownership of agent security.