AI Engineering/Phase 13/Lesson 15

MCP Security I — Tool Poisoning, Rug Pulls, Cross-Server Shadowing

Tool descriptions land in the model's context verbatim. Malicious servers embed hidden instructions that users never see. Research in 2025-2026 from Invariant Labs, Unit 42, and an arXiv study published March 2026 measured attack-success rates above 70 percent on frontier models and about 85 percent against state-of-the-art defenses under adaptive attacks. This lesson names the seven concrete attack classes and builds a tool-poisoning detector you can run in CI.

Learn 45 min Python (stdlib, hash-pin + poisoning detector)

Prerequisites: Phase 13 · 07 (MCP server), Phase 13 · 08 (MCP client)

#Learning Objectives

Name the seven attack classes: tool poisoning, rug pulls, cross-server shadowing, MPMA, parasitic toolchains, sampling attacks, supply-chain masquerading.
Understand why every attack works despite the tool interface looking correct.
Run mcp-scan (or equivalent) with hash pinning to detect description mutations.
Write a static detector for common injection patterns inside tool descriptions.

Full Access lesson

Keep going. The rest of this lesson is one step away.

Unlock all 503 lessons, video, code, quizzes and every future update. Pay in your own currency with Paystack.

See plans Sign in

The text and code of this lesson are based on AI Engineering from Scratch by Rohit Ghumare, MIT licensed.