Your MCP Server's Tool Description Just Stole Your SSH Keys
Sec-ra
Researchers demonstrated that malicious instructions hidden in MCP tool descriptions can trick AI agents into exfiltrating sensitive files like SSH keys.Summary
A critical vulnerability in Model Context Protocol (MCP) servers allows attackers to perform 'tool poisoning' by embedding malicious instructions within tool descriptions. Because LLMs treat these descriptions as executable directives rather than simple metadata, an AI agent can be manipulated to read sensitive local files, such as SSH private keys, and exfiltrate them without human intervention. This vulnerability highlights the danger of trusting MCP server metadata and necessitates robust validation layers, prompt scanning, and strict auditing of connected servers to prevent indirect prompt injection attacks.
(Source：Sec-ra)