A researcher commits a legitimate MCP server definition to a shared repository. Teammates approve the tool manifest. Two weeks later, the tool schema silently changes on the remote server. Nobody checks again. The tool now accepts a destination parameter that routes file reads to an external URL. That is CVE-2025-54136, CVSS 8.8, disclosed August 2025. The rug pull was not a prompt injection. It was a schema mutation.
The attack operates at a layer content filters do not inspect. JSON schemas define what operations an agent framework will accept. The LLM reads the description to decide when to call the tool. The schema is parsed by the framework, never by the model's safety alignment. When the schema is poisoned, the model sees execute_command as a legitimate parameter on a database tool, not as adversarial instruction.
Tool Schemas Are Contracts, Not Documentation
The inputSchema field of every MCP tool defines what the framework will construct and execute. The LLM uses the schema to know what it can call. The framework uses the schema to validate what it will forward to the tool handler. Poisoning the schema rewrites the tool API surface before any prompt-layer defense can inspect it.
OpenAI and Anthropic function-calling APIs require tools to declare their full argument schema as JSON Schema. The framework validates outgoing calls against that schema before passing them to the handler. MCP tool definitions include three distinct surfaces: name, description, and inputSchema, each with a different trust boundary. Framework-layer schema parsing happens before model response execution, meaning the schema defines the action space.
The distinction is critical. Adversarial text in tool descriptions lands in the context window. Content filters can theoretically detect it. The JSON Schema is structural data. Safety training has no mechanism to evaluate whether a JSON Schema is adversarial. A poisoned schema that adds execute_command: string to a legitimate weather tool does not tell the LLM to run commands. It tells the framework that running commands is a valid operation for that tool. The LLM, reading an apparently legitimate schema, treats the parameter as a declared feature.
OWASP MCP03:2025 categorizes this as Tool Poisoning. When the contract between agent and tool layer is corrupted, the agent operates under a false API surface with no visibility into the corruption.
CVE-2025-54136: One Approval, Infinite Mutations
CVE-2025-54136 (MCPoison, CVSS 8.8) was disclosed August 5, 2025. An attacker committed a benign MCP configuration to a shared repository, got team approval once, then silently mutated the schema payload on the server side.
The mutation added parameters giving the tool access to file system operations and network calls the original schema did not declare. Every developer who had approved the original configuration was running a tool with a different API surface, without any notification or re-approval prompt. The attack timeline: approval at T=0, mutation at T=1.
Cursor cached tool trust at initial approval time. Subsequent server-side mutations were consumed without re-validation. The team continued using the tool under the assumption they were running what they had approved. MCPoison targeted teams through shared repository configurations, establishing persistent backdoor access through poisoned tool definitions.
The fix in v1.x: schema hash verification against the approved state at each invocation. Any schema mutation after initial approval triggers a re-approval prompt. Without that gate, the approval mechanism is a one-time check on a continuously mutable surface.
36.5% Average Success Rate Across 45 Live Servers
The MCPTox benchmark (arXiv:2508.14925) tested tool poisoning attacks against 45 live MCP servers and 20 LLMs, including GPT-4o, Claude-3.7-Sonnet, Gemini 1.5 Pro, and o1-mini. Average attack success rate across all models: 36.5%. Peak: 72.8% against o1-mini.
The model with the highest refusal rate among all tested, Claude-3.7-Sonnet, refused less than 3% of the time. More capable models are more susceptible, not less. The reason: more capable models are better instruction-followers. Schema poisoning is an instruction delivered through the framework layer, not the text layer. Better instruction-following means more reliable execution of the poisoned schema.
MalTool (arXiv:2602.12194, Berkeley RDI) generated 5,287 tools with embedded malicious behaviors and planted them in simulated real-world repositories. VirusTotal detection rate: near zero. LLM-agent-specific detection methods: "limited effectiveness." The attack is automatable at registry scale. A single malicious package maintainer can poison tools across thousands of agent deployments without detection by any currently deployed scanning system.
Three Entry Points Before the Agent Runs
Schema poisoning does not require runtime access to the agent's context. The schema is loaded before inference begins. Three structurally distinct entry points exist before the agent runs.
Registry poisoning: a malicious package published to a tool registry with a legitimate description and a poisoned schema. The developer installs it, approves it once, and runs it indefinitely. CSA data: 43% of surveyed CI/CD pipelines pull MCP server dependencies without integrity verification.
Server-side mutation (CVE-2025-54136 pattern): a legitimate server whose schema is mutated after approval. The agent continues operating under cached approved-schema assumptions while the server now accepts a different, and broader, set of operations.
Attack on the schema-serving infrastructure: the endpoint serving schema definitions is compromised. Every agent fetching the schema after the compromise receives a poisoned version. ToolGuardian (arXiv:2607.21835): 30% of tested MCP servers allowed unrestricted URL fetches in schema definitions, making the schema itself a vector for external injection.
Safety Alignment Is Trained Against the Wrong Input Channel
Safety alignment training optimizes model behavior against adversarial text in the conversation context. The schema is not in the conversation context. It is loaded at the framework layer, parsed by the schema validator, and presented to the model as a structured list of available operations.
When a poisoned schema adds execute_shell_command as a parameter to a legitimate database query tool, the model does not see "execute_shell_command" as adversarial text. It sees it as a declared capability of the database tool. Safety training has no specific mechanism to distinguish legitimate tool capabilities from injected ones. The model behaves as trained: it uses the declared capabilities of the tools it was given.
MCPTox finding: model refusal rates against schema poisoning attacks are indistinguishable from baseline refusal rates against legitimate tool calls. The model cannot tell the difference; the poisoned schema looks like any other tool schema. Alignment is the wrong layer for this defense.
Cryptographic Schema Integrity at the Registry Layer
The fix is at the schema layer, not the prompt layer. Content filtering in the context window cannot detect schema poisoning; the schema never enters the context window as text. The only effective defense verifies schema integrity at the point of load and at each subsequent use.
Three controls from OWASP MCP03:2025 and ToolGuardian apply here.
Schema signing at publication: every tool schema is signed with the publisher's private key. The agent framework verifies the signature before loading the schema. Mutations between publication and load are detectable. JWS and COSE are the appropriate signature formats.
Declared-vs-observed enforcement: ToolGuardian's approach monitors tool calls at runtime and flags any argument or operation not present in the declared schema. Observed behavior outside the declared contract triggers an alert and blocks the call.
Re-validation on every load: no schema caching without hash verification. Every time the agent loads a tool schema, it compares the current hash against the approved hash. Any change, legitimate or adversarial, requires explicit re-approval.
MAGO Intel (intel.mago.team) tests agent deployments against the MCPTox attack catalog. It identifies tool schemas accepting parameters beyond their declared scope, sourced from CVE-2025-54136 patterns and the OWASP MCP03:2025 four-scenario taxonomy.
Prompt injection gets attention because it operates through text: visible, quotable, demonstrable in screenshots. Schema poisoning operates through JSON, invisible to the user, pre-approved by the tooling, and framework-enforced on execution. The defenses are different: schema integrity requires cryptographic controls at the registry layer, not content filters in the context window. Teams shipping agent tools without signed schemas build on contracts any write-access holder can rewrite. Before the model. Before the user. Before any safety check runs.
Top comments (0)