Attackers compromise MCP-connected tools to manipulate agent behavior, extract context, or return malicious outputs.

Malicious inputs trick agents into skipping validation steps and jumping directly to sensitive tool execution.

Malicious or unauthorized tools impersonate legitimate ones to hijack execution within MCP-based workflows.

LLMs misinterpret untrusted tool responses as prompts, allowing attackers to influence or control model behavior.

LLMs invoke backend actions they should not, due to missing or bypassed authorization checks.

Backends change tool behavior mid-session, breaking trust assumptions and enabling unexpected execution paths.