Everyone’s obsessing over prompt injection hiding in PDFs and websites.

Meanwhile the tool list itself — the thing every agent reads first — is wide open.

Part 2 of the MCP Bug Bounty series https://t.co/HrIfPkRHFM

The Tool List Itself Is the Attack. (MCP Bugbounty Series - Part 2)

Source: https://medium.com/@Aacle/the-tool-list-itself-is-the-attack-mcp-bugbounty-series-part-2-107e0311be94 Press enter or click to view image in full size

The MCP Bug Bounty Field Guide · Part 2 of 5 — how a malicious tool description hijacks a model, and how to write it up as a real bug.

30-second versionMCP tools are chosen by the model based on their text description. That description is just text the model reads as instructions. An attacker who controls it controls the model. No payload, no exploit, no CVE. This is a reportable bug, and most programs are leaving it open.

Previously in this series:Part 1 — MCP servers are the new open port 22, and almost nobody is hunting them.

In Part 1 we framed MCP as a bundle of tools an LLM is allowed to run.

Here’s the part most hunters miss: the model doesn’t pick a tool by name. It reads the tool’sdescriptionand decides whether to call it.

The description is text. The model treats text as instructions.

So whoever writes the description writes instructions the model will follow.

That is the whole bug. An attacker who can set or change a tool’s description can make the model do things the user never asked for — and it doesn’t look like an attack, because the model is “just using the tools it was given.”