How Malicious Text in MCP Tool Descriptions Can Hijack AI Model Behavior

Security researchers have highlighted a threat called 'tool description injection,' where malicious instructions are hidden inside the text fields of MCP (Model Context Protocol) tool definitions rather than in executable code. Because AI models read tool names, descriptions, and input schema details as context before deciding how to act, bad actors can embed prompt injection payloads in these fields to silently manipulate model behavior. The attack requires no software vulnerability, compromised dependency, or supply-chain breach — only a text field the model trusts. Threat actors can further obscure such payloads using zero-width Unicode characters, HTML comments, or base64-like strings that evade human review but are still parsed by the model. Standard security audits typically scan top-level description fields or runtime behavior, leaving injections buried in schema property descriptions or enum labels largely undetected.