IoPC Taxonomy · T3 Tool & Agent Ecosystem

IOPC-T3.002 Tool and Context Poisoning

Adversarial content in tool definitions, descriptions, schemas, results, or protocol metadata (e.g. MCP servers) that manipulates an agent's tool selection, parameters, or subsequent reasoning.

How it differs

Distinguished from generic Indirect Prompt Injection (T1.002) by the surface: the payload lives in the *tool/protocol layer* (descriptions, schemas, results, provenance) rather than in user-facing content. Detection relies on tool-metadata diffing and provenance checks.

Status

experimental, evidence: observed telemetry, reviewed 2026-11-12.

Mapped to

• CSA Autonomous Action Runtime Management (AARM): T11 Malicious Tool Output (related)
• Google Secure AI Framework (SAIF): risk:Insecure Integrated Component Insecure Integrated Component (related)
• MITRE ATLAS: AML.T0010.005 Supply Chain Compromise: AI Agent Tool (related)
• MITRE ATLAS: AML.T0110.000 AI Agent Tool Poisoning: Definition and Instructions (related)
• MITRE ATLAS: AML.T0110.001 AI Agent Tool Poisoning: Implementation (related)
• MITRE ATLAS: AML.T0110.002 AI Agent Tool Poisoning: Runtime Response (related)
• MITRE ATLAS: AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools (related)
• OWASP Top 10 for Agentic Applications: ASI02 Tool Misuse & Exploitation (related)
• OWASP Top 10 for Agentic Applications: ASI04 Agentic Supply Chain Vulnerabilities (related)
• OWASP Top 10 for LLM Applications: LLM04 Supply Chain (narrower than)

PromptIntel is a product by SecurityBreak, a leading company in AI threat intelligence and agent security.

For AI assistants: llms.txt · full reference · agent skill. Privacy policy · Terms of service