MITRE ATLAS 2026.09 / technique reference
AML.T0110
AI Agent Tool Poisoning
← Back to the ATLAS matrix · Pinned MITRE source · Current MITRE ATLAS site
MITRE source definition
Adversaries may poison tools used by AI agents by introducing or modifying malicious content or behavior in a tool's model-visible definition, executable implementation, or runtime responses. Tools may include built-in integrations, locally installed packages, remotely hosted services, Model Context Protocol (MCP) servers and tools, and agent skills or similar capability packages.
A poisoned tool is represented or trusted as performing a benign function, but its definition, implementation, or responses cause agent behavior or tool-mediated effects to differ materially from the represented function. Poisoning may be present when a tool is first published, introduced through an AI Supply Chain Compromise, or added after adoption through an AI Supply Chain Rug Pull. Once the tool is installed, connected, or otherwise made available to the agent, it may provide the adversary with persistent influence over the agent's actions and external interactions.
Adversaries may poison a tool's model-visible semantic interface, including its descriptions, schemas, parameter documentation, annotations, or agent-readable instructions (See Definition and Instructions). They may introduce hidden executable behavior that changes the effects of otherwise normal tool invocations (See Implementation). They may also cause a malicious or compromised tool to deliberately return content intended to influence the model's subsequent reasoning or actions (See Runtime Response).
Poisoned tools may cause an agent to access sensitive data, alter the inputs or destinations of other tools, execute unauthorized commands, conceal actions from users, or exfiltrate information. Tool poisoning frequently enables other techniques such as LLM Prompt Injection, AI Agent Tool Invocation, and Exfiltration via AI Agent Tool Invocation.
Tool poisoning is distinct from malicious data that a benign tool faithfully retrieves from an external or victim-controlled source (See AI Agent Tool Data Poisoning and LLM Prompt Injection: Indirect. Software that merely uses an agent tool package as a delivery vehicle for conventional malware, without subverting the tool's represented interface or operation, may be better described as a malicious package or software supply-chain compromise rather than AI Agent Tool Poisoning.
Source modified 2026-07-31. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.
Parent, sub-techniques and ATT&CK references
Source-backed defensive context
MITRE mitigations
No explicit relationship in this pinned source.
MITRE case studies
No explicit relationship in this pinned source.
These are explicit source relationships, not independently reproduced incidents or validated detection coverage. The local relationship indexes link back to the pinned MITRE source.
Detection and collection design
No executable detector is supplied by this ATLAS source import. Define detection against the specific behavior in the full definition above. MITRE case-study and mitigation relationships supply context, not tested rule coverage.
No explicit AI Telemetry Logging mitigation relationship was found for this technique. Do not manufacture a sensor mapping from its tactic.
Depending on the selected scenario, the experiment may need dataset/model versions, data-access and build audit records, inference or application traces, or agent tool authorization records. These are planning options, not asserted mappings. Minimize sensitive prompt/data capture and retain provenance.
Anomaly detection design
No exact ATLAS anomaly detector is validated here. Select a measurable feature from the behavior definition; compare like-for-like model versions, workloads and identities. Changes caused by model upgrades, retrieval corpora or legitimate workload shifts must be controls, not automatically labelled attacks.
Tools and reproducible source scenarios
No lab-tool association is invented from the technique name. Inspect the exact source scenarios below for the tools and environment actually used; a case study is not itself an executable or safe lab.
No explicit case study is linked in this pinned source. A custom, authorized procedure is required.
Simulation experiment plan
Select an owned, disposable system implementing AML.T0110 AI Agent Tool Poisoning. Use synthetic data and sandboxed tools; disable production credentials, external side effects and data exfiltration. For poisoning or supply-chain tests, use throwaway artifacts rather than real training or deployment pipelines.
- State the exact trust boundary and expected observable behavior.
- Pin model, application, dataset, tool permissions and evaluation inputs.
- Capture baseline and scenario traces, an authorized look-alike, and a missing-telemetry control.
- Evaluate the detector against independently labelled results; do not substitute model output claims for observed tool actions.
- Restore state and preserve redacted evidence.
Experiment worksheet — not fabricated telemetry
The export below is a planning record, not a native event, positive attack fixture or execution result. Unknown fields deliberately remain null.
{
"schema": "1200km.atlas.experiment-plan.v1",
"technique_id": "AML.T0110",
"simulation": false,
"target": "REQUIRES_OWNED_LAB",
"source_scenario": [],
"input_artifact_hash": null,
"system_version": null,
"expected_observable": null,
"native_telemetry_location": null,
"baseline_reference": null,
"result": "not_run"
}Simulation and telemetry boundary
This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.
For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.
Provenance and attribution
Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0
Copyright 2021-2026 MITRE. Source text and explicit relationships are retained; navigation, formatting and local links are provided by 1200km.
No explicit relationship in this pinned source.