EE
FR Contact

Poisoned MCP tool descriptions make Cursor leak SSH keys and WhatsApp chats

Proof of concept Manipulation Severity 3 significant Corroborated 82% Switzerland

Zurich-based Invariant Labs showed that hidden instructions in an MCP server's tool descriptions, visible to the model but not to users, could make the Cursor agent read the user's ~/.cursor/mcp.json and SSH keys and pass them to a malicious server, or silently send all emails written through a trusted email tool to an attacker. A follow-up demo used a 'sleeper' server that changed its tool description after approval to make Cursor exfiltrate a user's WhatsApp chat history through a trusted whatsapp-mcp server. In both cases Cursor's confirmation dialog hid the payload.

Invariant called the techniques tool poisoning, rug pulls and tool shadowing, and said the attack works with any MCP client that does not properly validate or display tool descriptions. In a second WhatsApp experiment no malicious server was needed: a message sent to the victim was enough to make the agent leak the user's contacts.

What would have stopped it

Show users full tool descriptions and arguments, and pin MCP tool definitions so they cannot change after approval.

Guardrails

3 of 8 failed
  1. G1 Least privilege Failed Agent could read SSH keys and MCP credentials unrelated to the task.
  2. G2 Human confirmation Partial Cursor asked for confirmation, but the dialog hid full tool arguments and payloads.
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Failed Agent obeyed hidden instructions in a third-party tool description.
  5. G5 Truthfulness Failed Agent masked the exfiltration behind innocuous explanations to the user.
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
  8. G8 Recovery Not assessed Could the damage be undone?

Sources

2 primary, 1 specialist
  1. MCP Security Notification: Tool Poisoning Attacks Invariant Labs, 1 Apr 2025
    “We inject Cursor with our prepared add tool, and trick it into leaking the user's mcp.json configuration file (with possibly other MCP servers credentials) and also SSH keys.”
    Primary Quote checked Archived copy
  2. WhatsApp MCP Exploited: Exfiltrating your message history via MCP Invariant Labs, 7 Apr 2025
    “This blog post demonstrates how an untrusted MCP server can attack and exfiltrate data from an agentic system that is also connected to a trusted WhatsApp MCP instance, side-stepping WhatsApp's encryption and security measures.”
    Primary Quote checked Archived copy
  3. Model Context Protocol has prompt injection security problems Simon Willison's Weblog, 9 Apr 2025
    “Invariant Labs described tool poisoning attacks, a specialized form of prompt injection where malicious instructions are tucked away in the tool descriptions themselves—visible to the LLM, not normally displayed to users.”
    Specialist Quote checked Archived copy

Confidence 82% comes from these sources alone. How we score

History

  1. 15 Oct 2026Entered in the register with 3 sources

Similar failures

All incidents
  1. EEAIR-2025-018 Jul 2025 Support-ticket prompt injection makes Cursor agent leak private tables via Supabase MCP Supabase MCP server in CursorProof of concept 70%
  2. EEAIR-2025-014 May 2025 Malicious GitHub issue hijacks agents using GitHub's MCP server to leak private repo data GitHub MCP serverProof of conceptSwitzerland 89%
  3. EEAIR-2023-002 Mar 2023 Hidden text on web pages turns Bing Chat into a scammer seeking users’ data Bing Chat (GPT-4) in the Microsoft Edge sidebar, Microsoft; OpenAIProof of conceptEU 98%