Skip to content
Agent Threat Rules (ATR)中文
II. Threat categories · Ε

Ε. Tool Poisoning

Poisoned tool descriptions and malicious tool responses

Rule files
118
Effective
116, loaded by at least one lane
Enforce lane
13, stable only
Download
rules/index.csv

Most frequent crosswalks

The number in brackets is how many rules in this category carry that item. ATR wrote these mappings; the framework owners have not reviewed or endorsed them.

MITRE ATLAS
  • AML.T0049 - Exploit Public-Facing Application(31)
  • AML.T0053 - AI Agent Tool Invocation(30)
  • AML.T0051.001 - Indirect(21)
  • AML.T0051 - LLM Prompt Injection(16)
  • AML.T0053 - LLM Plugin Compromise(13)
  • AML.T0040 - AI Model Inference API Access(11)
OWASP Agentic Top 10
  • ASI05:2026(62)
  • ASI02:2026(42)
  • ASI04:2026(36)
  • ASI03:2026(17)
  • ASI01:2026(15)
  • ASI06:2026(12)

Rules

IDTitleSeverityMaturityLanes
ATR-2026-00010Malicious Content in MCP Tool Responsecriticaltestalert · hunt
ATR-2026-00013SSRF via Agent Tool Callscriticaltestalert · hunt
ATR-2026-00095MCP Tool Supply Chain Poisoningcriticaltestnone, inert
ATR-2026-00096Skill Registry Poisoning and Compromised Tool Distributioncriticaltestnone, inert
ATR-2026-00103Hidden LLM Safety Bypass Instructions in Tool Descriptionscriticaltestalert · hunt
ATR-2026-00161MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attackcriticaltestalert · hunt
ATR-2026-00210Flowise System Message Override via Template Interpolation (CVE-2025-59528)criticaltestalert · hunt
ATR-2026-00277ECHO Template / Jinja / SQL Command Injection via LLMcriticaltestalert · hunt
ATR-2026-00415Flowise Custom MCP STDIO Command Injection (CVE-2026-40933)criticaltestalert · hunt
ATR-2026-00419Cursor MCP JSON Zero-Click Configuration RCE (CVE-2025-54136)criticaltestalert · hunt
ATR-2026-00434mcp-remote authorization_endpoint OS Command Injection (CVE-2025-6514)criticalstableenforce · alert · hunt
ATR-2026-00494SQL Injection and Code Injection Attack Payload Detectioncriticaltestalert · hunt
ATR-2026-00521Shell Command Injection in Agent Tool Contextcriticaltestalert · hunt
ATR-2026-00526Claude Code Shell Metacharacter in Double-Quoted File Pathcriticaltestalert · hunt
ATR-2026-00529LiteLLM Proxy SQL Injection (CVE-2026-42208, CISA KEV 2026-05-08)criticaltestalert · hunt
ATR-2026-00530ModelScope MS-Agent Shell Tool Unsanitized Argv RCE (CVE-2026-2256)criticaltestalert · hunt
ATR-2026-00531PraisonAI Unauthenticated Agent API Exploitation (CVE-2026-44338)criticaltestalert · hunt
ATR-2026-00532Apache Doris MCP Server SQL Injection (CVE-2025-66335)criticaltestalert · hunt
ATR-2026-00533Apache Pinot MCP Unauthenticated Remote Cluster Takeovercriticaltestalert · hunt
ATR-2026-00536nginx-ui MCP Endpoint Unauthenticated Command Execution (CVE-2026-33032)criticaltestalert · hunt
ATR-2026-00538LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617)criticaldrafthunt
ATR-2026-00540PraisonAI parse_mcp_command() CLI Argument Command Injection (CVE-2026-34935)criticaldrafthunt
ATR-2026-00544PraisonAI MCP Path-Traversal .pth Injection RCE (GHSA-9mqq-jqxf-grvw)criticaldrafthunt
ATR-2026-00545PraisonAI tool_override.py Unauthenticated RCE — CVE-2026-40287 Patch Bypass (CVE-2026-44334)criticaldrafthunt
ATR-2026-00561FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_namecriticaltestalert · hunt
ATR-2026-00572SymJack — Symlink Approval-Path Spoofing Redirects Writes into Agent MCP/Config (RCE on Restart)criticaltestalert · hunt
ATR-2026-00575Miasma / Phantom Gyp — npm Worm Backdoors AI-Agent Config Files (binding.gyp install-exec + auto-run config injection)criticaltestalert · hunt
ATR-2026-00576Hades / Shai-Hulud — AI-Agent Credential Harvester in Supply-Chain Package (Anthropic / Claude / MCP key theft + exfil)criticalexperimentalhunt
ATR-2026-00577Command Injection in create-mcp-server-stdio via Unsafe exec() Concatenation (CVE-2025-54994)criticalexperimentalhunt
ATR-2026-00715Tool Knowledge Hijack — Identity Injection with Tool Call Argumentscriticalstableenforce · alert · hunt
ATR-2026-01300MCP Tool Description — Notes Parameter Chat-History Exfiltrationcriticaltestalert · hunt
ATR-2026-01302Fake Tool Result Prefix — Injected Instruction via Simulated Completioncriticalstableenforce · alert · hunt
ATR-2026-01306MCP OAuth Authorization URL — Command Injection via URL Authoritycriticalstableenforce · alert · hunt
ATR-2026-01307MCP DNS Rebinding Attack — Hostname Time-Based IP Switchingcriticalstableenforce · alert · hunt
ATR-2026-01310MCP Tool Description — Compliance/Audit Framing for Mandatory Chat Contextcriticalstableenforce · alert · hunt
ATR-2026-01931gemini-mcp-tool execAsync Command Injection & @file Exfiltration (CVE-2026-0755)criticaltestalert · hunt
ATR-2026-01935LiteLLM Custom-Code Guardrail Sandbox Escape (CVE-2026-40217)criticaltestalert · hunt
ATR-2026-01952PraisonAI codeMode JS Sandbox Escape RCE via new Function/with() (GHSA-p69m-4f92-2v84)criticaltestalert · hunt
ATR-2026-01953npm PraisonAI codeMode Sandbox Escape via Function Constructor Prototype Chain (GHSA-vmmj-pfw7-fjwp)criticaltestalert · hunt
ATR-2026-01959OpenHuman Shell Tool Allowlist Bypass via Env-Prefix / find -execdir (CVE-2026-55743)criticaltestalert · hunt
ATR-2026-01963PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)criticaltestalert · hunt
ATR-2026-01965Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)criticaltestalert · hunt
ATR-2026-01967DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)criticaltestalert · hunt
ATR-2026-01968DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)criticaltestalert · hunt
ATR-2026-01970PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)criticaltestalert · hunt
ATR-2026-01973AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)criticaltestalert · hunt
ATR-2026-01978AnythingLLM collector /process filename Path Traversal Arbitrary File Deletion (CVE-2023-5832)criticaltestalert · hunt
ATR-2026-01979PandasAI Interactive Prompt Injection -> Python Sandbox Escape RCE (CVE-2024-12366 / GHSA-vv2h-2w3q-3fx7)criticaltestalert · hunt
ATR-2026-01980Agentic-Flow MCP Tool-Parameter OS Command Injection (GHSA-vcv2-r9jh-99m5)criticaltestalert · hunt
ATR-2026-01983MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)criticaltestalert · hunt
ATR-2026-01985MCP Connect: Unauthenticated /bridge Endpoint Arbitrary Process Spawn RCE (GHSA-wvr4-3wq4-gpc5)criticaltestalert · hunt
ATR-2026-01987Langroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879)criticaltestalert · hunt
ATR-2026-02021MCP Inspector Unauthenticated Proxy stdio Command Execution (CVE-2025-49596)criticaltestalert · hunt
ATR-2026-02027Diagnostic Content Remediation Command Injection (Agentjacking)criticaltestalert · hunt
ATR-2026-02041Shell Command Injection via Echo-Marker Proof-of-Concept in Tool Argumentcriticalexperimentalhunt
ATR-2026-02141Unsandboxed Command Execution via Dynamic MCP Server Config (command/args Injection)criticalexperimentalhunt
ATR-2026-02145Python Sandbox Escape via Generator/Coroutine Frame Object Introspectioncriticalexperimentalhunt
ATR-2026-02194Malicious Go init() Function Spawning a Process via a Code-Generation Toolcriticalexperimentalhunt
ATR-2026-00011Instruction Injection via Tool Outputhightestalert · hunt
ATR-2026-00012Unauthorized Tool Call Detectionhighexperimentalhunt
ATR-2026-00100Consent Bypass via Hidden LLM Instructions in Tool Descriptionshightestalert · hunt
ATR-2026-00101Trust Escalation via Authority Override Instructionshightestalert · hunt
ATR-2026-00105Silent Action Concealment Instructions in Tool Descriptionshightestalert · hunt
ATR-2026-00106Schema-Description Contradiction Attackhightestalert · hunt
ATR-2026-00209MCPwn Runaway Tool Invocation via Retry Directive (CVE-2026-33032)hightestalert · hunt
ATR-2026-00259ANSI Escape Code Terminal Injectionhightestalert · hunt
ATR-2026-00270XSS Payload Injection in Tool Response Outputhightestalert · hunt
ATR-2026-00393ANSI Code Elicitation Requesthightestalert · hunt
ATR-2026-00435Azure MCP Server Missing Authentication for Critical Function (CVE-2026-32211)highstableenforce · alert · hunt
ATR-2026-00448Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)hightestalert · hunt
ATR-2026-00513Package Hallucination Exploitation — AI-Suggested Fake Package Installationhighstableenforce · alert · hunt
ATR-2026-00522SQL Injection via Natural Language Agent Interfacehightestalert · hunt
ATR-2026-00534Alibaba RDS MCP Unauthenticated Database Metadata Exfiltrationhightestalert · hunt
ATR-2026-00537FastMCP Windows cmd.exe Injection via Server Name Metacharacters (CVE-2025-64340)highdrafthunt
ATR-2026-00541Agent Zero MCP Configuration Command Injection via mcp_servers field (CVE-2026-30624)highdrafthunt
ATR-2026-00542Upsonic MCP Command Allowlist Bypass RCE (CVE-2026-30625)highdrafthunt
ATR-2026-00543LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623)highdrafthunt
ATR-2026-00567MCP stdio server config command injection via unvalidated test endpointshightestalert · hunt
ATR-2026-00568Agent SSRF to cloud metadata / file inclusion via unvalidated fetch URLhightestalert · hunt
ATR-2026-00581MCP Tool Rug-Pull — Post-Approval Description Redefinition Injects Execution Instructionshightestalert · hunt
ATR-2026-00714Tool Camouflage — Forced Specific Tool Invocation via Injected Instructionhighstableenforce · alert · hunt
ATR-2026-00716Indirect PI — Data Destruction Instruction via Agent File/Document Toolhighstableenforce · alert · hunt
ATR-2026-01301MCP Tool Description — Exclusive Tool Invocation Overridehighstableenforce · alert · hunt
ATR-2026-01303Tool Schema Enumeration via Social Engineeringhighstableenforce · alert · hunt
ATR-2026-01775MCP Tool-Manifest Poisoning — Name Squatting, Result Shadowing & Covert-Action Directives (Semantic)hightestalert · hunt
ATR-2026-01927mcp-server-kubernetes Command Injection in kubectl_scale / kubectl_patch / explain_resource (CVE-2025-53355)hightestalert · hunt
ATR-2026-01928Framelink Figma MCP Server curl-Fallback Command Injection (CVE-2025-53967)highexperimentalhunt
ATR-2026-01930MCP Sampling Prompt Injection (Server-to-Client createMessage Abuse)hightestalert · hunt
ATR-2026-01932Shadow / Undeclared MCP Server Registration (MCP-38: MCP-18)hightestalert · hunt
ATR-2026-02022CurXecute — Cursor .cursor/mcp.json Injected-Server Auto-Exec RCE (CVE-2025-54135)hightestalert · hunt
ATR-2026-02023EscapeRoute — Filesystem MCP Server Directory Prefix-Bypass (CVE-2025-53110)hightestalert · hunt
ATR-2026-02024EscapeRoute — Filesystem MCP Symlink Escape to LaunchAgent Persistence (CVE-2025-53109)hightestalert · hunt
ATR-2026-02025MCP Full Schema Poisoning — Injected Directive in Non-Description inputSchema Field (MCP-11)hightestalert · hunt
ATR-2026-02102HTML/Script Injection in Tool Call Argument Targeting a Human-Approval Dashboardhighexperimentalhunt
ATR-2026-02193SSRF via Non-Canonical IPv6 Encoding of Loopback/Internal Addresseshighexperimentalhunt
ATR-2026-02233Unscoped Destructive or Mass-Disclosure Database Operation Request via Natural Languagehighexperimentalhunt
ATR-2026-02260Remediation-Framed Command Execution in Tool Response (Agentjacking)highexperimentalhunt
ATR-2026-02263SQL Injection via Unparameterized Template-Expression Value in Workflow-Automation SQL Node (CVE-2026-59257)hightestalert · hunt
ATR-2026-02350MCP JSON-RPC Message Carries Case-Duplicate name/arguments Keys to Smuggle an Unauthorized Tool Callhighexperimentalhunt
ATR-2026-02352Email Search/Reply Tool Argument Breaks Out of IMAP SEARCH Quoted String to Inject IMAP Commandshighexperimentalhunt
ATR-2026-02372Unsigned Automated Task/Validation Feed Invokes npm install / npx -y (Lifecycle-Script RCE)highexperimentalhunt
ATR-2026-02376MCP Tool Description Defines a Common-Phrase Trigger to Forward Full Conversation Historyhighexperimentalhunt
ATR-2026-02403MCP Tool Returns Untrusted External Content Carrying Hidden Agent Instructions Without Spotlightinghightestalert · hunt
ATR-2026-02557Shell Command Separator Inside a Path-Typed MCP Tool Argumenthightestalert · hunt
ATR-2026-02666Trusted Hostname Parked in the URL Userinfo So the Real Host Is Whatever Follows the At-Signhightestalert · hunt
ATR-2026-02668Branch or Tag Ref Name Carrying Shell Command Substitution in Tool Outputhightestalert · hunt
ATR-2026-02707Mail or Attachment Tool Argument Splits into a New Header via Embedded CRLFhightestalert · hunt
ATR-2026-02817Untrusted Tool Result Dictates a Tool Call by Schema Parameter Namehightestalert · hunt
ATR-2026-02864Non-Canonical Numeric IPv4 Host in a URL-Typed Tool Argument (SSRF Filter Bypass)hightestalert · hunt
ATR-2026-02868SSRF via IPv6 Transition Address Embedding a Private IPv4 Targethightestalert · hunt
ATR-2026-02870Invisible Unicode Control Before a Directive in a Tool Description or Skill Filehightestalert · hunt
ATR-2026-00720Tool Misuse — Privilege Escalation via Social Engineering Agent to Grant Accessmediumstableenforce · alert · hunt
ATR-2026-01982dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)mediumtestalert · hunt
ATR-2026-02514MCP Server Descriptor URL Field Carries an HTML/Script Breakout Payloadmediumtestalert · hunt
ATR-2026-02542Observability Query Tool Argument Appends a Pipeline Stage and Comments Out the Rest of the Querymediumtestalert · hunt
ATR-2026-02669Query-Language Pipeline Stage Smuggled Into an Identifier-Typed Tool Parametermediumtestalert · hunt
ATR-2026-02682XML/SVG Entity Expansion Bomb in Content Returned to an Agentmediumtestalert · hunt
ATR-2026-02865Read-Only Allow-Listed Utility Invoked With a File-Write or State-Changing Option in a Command Argumentmediumtestalert · hunt
Page generated 2026-11-10Something wrong or missing? Open an issue