# AX-SYS-12: Treat tool descriptions as a trust boundary

> Tools and capabilities · advanced · AX-SYS-12

Tool metadata enters the model's context, so guard it against hidden instructions and silent changes (tool poisoning, rug pulls).

## Why

Tool descriptions are not passive documentation — they enter the model's context and directly shape its decisions. OWASP MCP03 (Tool Poisoning) is a documented attack class where adversaries inject malicious instructions into tool metadata to hijack model behavior. The MCPTox benchmark (arxiv:2508.14925) measured this across 20 LLM agents and found it widely effective: o1-mini was poisoned in 72.8% of cases, and even the most resistant model refused fewer than 3% of attacks. A "rug pull" (silently changing a tool's description after it has been reviewed) is an equally dangerous variant. Treat any tool description change as a security event requiring review.

## Do

Pin and review tool descriptions, and scan for injected instructions.

## Don't

Load third-party tools without inspecting their metadata.

## Artifact

Process artifact: pin tool descriptions to reviewed versions, diff them on update, and scan third-party tool metadata for injected instructions before loading. Treat a silent description change as a security event.

## Citations

1. [OWASP MCP Top 10 — MCP03: Tool Poisoning](https://owasp.org/www-project-mcp-top-10/) — Tool poisoning occurs when an adversary compromises tools or their outputs to inject malicious context, manipulating model behavior; it is a documented attack class in the OWASP MCP Top 10
2. [arxiv:2508.14925 — MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers](https://arxiv.org/abs/2508.14925) — Across 20 LLM agents tested on 1,312 malicious cases over 45 real-world MCP servers, tool poisoning was widely effective: o1-mini reached a 72.8% attack success rate, and the highest refusal rate (Claude-3.7-Sonnet) was under 3%
3. [Mindgard — The State of MCP Security](https://mindgard.ai/blog/mcp-security-statistics-and-benchmarks) — In a study of MCP platforms, 85% of tested attacks compromised at least one platform, with prompt-injection attacks succeeding just over 70% of the time

---
Source: Agent Experience Principles (axprinciples.com)