GCD AI RADAR
incidents/AIR-2026-0348

Credential Exfiltration via Remote Poisoned MCP Tool

Attack on AI1 Research / proof of conceptPrompt injectionAgent hijackData leak

Researchers demonstrated that AI agents configured with remote Model Context Protocol tools can be manipulated by malicious docstring prompts. The proof-of-concept forced agents to read local credential files and leak them.

Details

type
Attack on AI
An AI model, agent or AI-powered product was the thing exploited, abused or leaked.
categories
  • Prompt injectionprimary
    Untrusted content (web pages, documents, emails, tool output) steers a model into ignoring its instructions.
  • Agent hijack
    An AI agent is tricked into unauthorized actions: tool misuse, data exfiltration through the agent, or acting against its principal.
  • Data leak
    Training data, chat logs, system prompts, model weights or other AI-system data exposed.
owasp llm top 10
mitre atlas
Both rows are derived from the type and categories (OWASP 2025 edition, ATLAS release 2026.09), not classified per record. How
severity
1 · Research / proof of concept
Demonstrated by researchers; no known real-world exploitation.
targets
Framework / tooling
products
Model Context Protocol
incident date
1 Apr 2025
first reported
31 Mar 2026
origin
MITRE ATLAS
Derived from MITRE ATLAS (Apache 2.0, © MITRE).
classifier confidence
0.95 · published at or above 0.80; see the methodology
tags
mcp · prompt-injection · data-exfiltration
record
created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z · json

Sources · 2

  1. 2026-03-31
    Data Exfiltration via Remote Poisoned MCP Tool
    MITRE ATLAS · atlas.mitre.org/studies/AML.CS0054
  2. 2026-03-31
    MCP Security Notification: Tool Poisoning Attacks
    Invariant Labs · invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks

Titles and links belong to their publishers. The summary above is written by GCD AI RADAR in its own words; data is CC BY-SA 4.0.

Related incidents