# Tool Poisoning

Source: https://customlabs.io/glossary/tool-poisoning/
Updated: 2026-09-13

Security & governance

# Tool Poisoning

Tool poisoning hides an instruction in a tool's description that the model reads as legitimate.

It works because nothing marks a description field as untrusted data rather than a directive.

A server never called maliciously can still poison the session the moment its tools are listed.

Treating every description as untrusted unless the server is vetted is the standing defense.

[MCP in Production](https://customlabs.io/mcp/)[Insight: Prompt injection threat model](https://customlabs.io/insights/prompt-injection-threat-model/)

[← Back to the full glossary](https://customlabs.io/glossary/)

## Related terms

[Model Context Protocol (MCP) MCP is an open standard for connecting LLM applications to tools and data sources.](https://customlabs.io/glossary/model-context-protocol/)[MCP Gateway An MCP gateway is a shared layer in front of several MCP servers, centralizing controls.](https://customlabs.io/glossary/mcp-gateway/)[Prompt Injection Prompt injection is untrusted input crafted to override a model's system prompt or task.](https://customlabs.io/glossary/prompt-injection/)

## More in Security & governance

[Data Processing Agreement (DPA) A DPA is the contract naming a vendor as a processor of personal data.](https://customlabs.io/glossary/data-processing-agreement/)[Data Residency Data residency is where data is physically processed and stored, not where users are located.](https://customlabs.io/glossary/data-residency/)[Red Teaming Red teaming is deliberately attacking your own AI system to find what breaks first.](https://customlabs.io/glossary/red-teaming/)[AI Register An AI register is a current list of every system that touches a model.](https://customlabs.io/glossary/ai-register/)