MITRE ATLAS 2026.09 / technique reference
AML.T0110
AI Agent Tool Poisoning
MITRE source definition
Adversaries may poison tools used by AI agents by introducing or modifying malicious content or behavior in a tool's model-visible definition, executable implementation, or runtime responses. Tools may include built-in integrations, locally installed packages, remotely hosted services, Model Context Protocol (MCP) servers and tools, and agent skills or similar capability packages.
A poisoned tool is represented or trusted as performing a benign function, but its definition, implementation, or responses cause agent behavior or tool-mediated effects to differ materially from the represented function. Poisoning may be present when a tool is first published, introduced through an [AI Supply Chain Compromise](/techniques/AML.T0010), or added after adoption through an [AI Supply Chain Rug Pull](/techniques/AML.T0109). Once the tool is installed, connected, or otherwise made available to the agent, it may provide the adversary with persistent influence over the agent's actions and external interactions.
Adversaries may poison a tool's model-visible semantic interface, including its descriptions, schemas, parameter documentation, annotations, or agent-readable instructions (See [Definition and Instructions](/techniques/AML.T0110.000)). They may introduce hidden executable behavior that changes the effects of otherwise normal tool invocations (See [Implementation](/techniques/AML.T0110.001)). They may also cause a malicious or compromised tool to deliberately return content intended to influence the model's subsequent reasoning or actions (See [Runtime Response](/techniques/AML.T0110.002)).
Poisoned tools may cause an agent to access sensitive data, alter the inputs or destinations of other tools, execute unauthorized commands, conceal actions from users, or exfiltrate information. Tool poisoning frequently enables other techniques such as [LLM Prompt Injection](/techniques/AML.T0051), [AI Agent Tool Invocation](/techniques/AML.T0053), and [Exfiltration via AI Agent Tool Invocation](/techniques/AML.T0086).
Tool poisoning is distinct from malicious data that a benign tool faithfully retrieves from an external or victim-controlled source (See [AI Agent Tool Data Poisoning](/techniques/AML.T0099) and [LLM Prompt Injection: Indirect](/techniques/AML.T0051.001). Software that merely uses an agent tool package as a delivery vehicle for conventional malware, without subverting the tool's represented interface or operation, may be better described as a malicious package or software supply-chain compromise rather than AI Agent Tool Poisoning.
Source modified 2026-07-31. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.
Parent, sub-techniques and ATT&CK references
Source-backed defensive context
MITRE mitigations
No explicit relationship in this pinned source.
MITRE case studies
No explicit relationship in this pinned source.
These are explicit source relationships, not independently reproduced incidents or validated detection coverage.
Simulation and telemetry boundary
This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.
For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.
Provenance and attribution
Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0
Copyright 2021-2026 MITRE. Source text and explicit relationships are retained; navigation, formatting and local links are provided by 1200km.
No explicit relationship in this pinned source.