Imagine you hire a translator to sit between you and a dozen foreign contractors. You trust the translator to relay your instructions faithfully. Now imagine every contractor gets to whisper extra instructions into the translator's ear — instructions you never see — and some of those whispers say "quietly send this client's bank details to my friend." That is MCP tool poisoning. The Model Context Protocol is the translator, the contractors are external tool providers, and the whispers are attacker-controlled content embedded in tool descriptions, schema fields, and response data that flow into the language model's context without validation. The committed claim: this is the first cross-framework measurement study of MCP tool poisoning that confirms real tool execution and verified data exfiltration, not just model compliance with poisoned instructions. Prior work asked "did the model say it would do the bad thing?" This paper asks "did the secret actually arrive at the attacker's server?" The answer, across a 9,720-cell susceptibility matrix (12 frameworks × 18 models × 45 attack scenarios), is yes — 22.9% of cells are vulnerable. Of those 2,113 vulnerable cells, 64.9% dispatch an attacker tool call, 23.0% contact the attacker endpoint, and 12.1% verifiably exfiltrate a secret confirmed by canary HTTP receipt. The architecture of the study is straightforward and well-constructed. The authors built an open-source tool called mcpvenom that generates poisoned MCP tool descriptions across a 25-class root-cause taxonomy (unifying prior scattered classifications). A dual-oracle system confirms exfiltration: first, did the model dispatch the call, and second, did the attacker's HTTP endpoint receive a canary token? This two-stage verification is what separates this work from prior benchmarks that stopped at "the model agreed to do it." The 25-class taxonomy itself is a genuine contribution — it maps the full attack surface from rug-pull attacks to cross-tool shadowing to response injection. The most striking finding is where defense lives: nowhere intentionally, and almost entirely at the model level. Nine core frameworks cluster within a tight 23–26% attack success rate band (chi-squared = 3.30, p = 0.91), meaning framework choice is essentially irrelevant to security. Model choice, by contrast, swings ASR from 0.4% to 49.7%. Claude Opus 4.8 is the standout — vulnerable in only 8 of 530 cells while issuing 223 explicit refusals. A code-level audit of all twelve frameworks found zero intentional defenses. Some frameworks show incidental mitigation through architectural quirks (tool call serialization, context window limits), but none by design. The integrity story is strong for a security paper. The dual-oracle eliminates the biggest weakness in prior work (model-says-it-would vs. model-actually-did). The 9,720-cell matrix is large enough to support the statistical claims. The authors tested a regex-based description scanner as a partial control: it rejects 20 of 45 scenarios at a 7.2% false-positive rate, establishing a useful baseline while honestly calling it partial. All five coordinated disclosures to four vendors were rejected — a detail that quietly says everything about how the ecosystem currently treats this threat class. The milestone question is concrete: what would "defended" look like? The paper implicitly argues the next number is 0% exfiltration rate on this exact matrix. Currently the best model (Claude Opus 4.8) sits at 1.5% cell vulnerability; the worst is near 50%. A framework-level defense that drops the overall 22.9% to under 5% without crippling tool utility would be the meaningful next threshold. The regex scanner gets partway there on description-based attacks but cannot touch response-data or schema-field injection. The gap is that no one is building these defenses — the vendor rejection of all disclosures confirms this. The obvious experiment the authors did not run: multi-turn, multi-tool chain attacks where poisoning compounds across sequential tool calls in a single agent session. The paper tests individual attack scenarios in isolation. Real agentic workflows chain 5–20 tool calls, and the compounding effect of partial context poisoning across a chain is likely worse than isolated cell measurements suggest. The honest read: this is probably (a) compute and scope — the matrix is already 9,720 cells — and (c) it's the obvious next paper. The single-scenario measurement had to come first to establish the baseline.
