Malicious MCP Tool
Testing what a single deliberately malicious tool exposed via MCP can do once an agent is willing to call it.
- Category
- MCP Security
- Difficulty
- Intermediate
- Last Updated
- 20 September 2026
Lab detail
Objective
Where ASL-015 tests trust in the MCP server itself, this lab narrows in on a single tool definition — a tool whose description is written to manipulate the agent’s planning (a form of indirect prompt injection embedded in tool metadata) or whose implementation does something other than what it claims. This lab will build a reference malicious tool and test its effect on agent behavior.
Planned Scope
- Build a reference tool with a misleading description designed to influence agent tool-selection.
- Build a reference tool whose implementation silently performs an unrequested action.
- Test how an agent’s planning and tool-selection logic responds to both.
- Document tool-review and sandboxing practices that catch this class of tool.
Framework Mapping
Referenced frameworks
Exact control-ID mappings are to be validated as this lab progresses — see the full Frameworks reference.
Responsible Use / Safety Notes
How this lab is run
This lab uses synthetic data and controlled environments. It is intended to demonstrate defensive AI-security principles and does not contain customer data, production credentials or intentionally weaponized exploit infrastructure.
A decision is waiting for sign-off. Get an independent view first.
Tell me what is being decided and what is at stake. I will first say honestly whether my experience fits — then we talk about scope, not before.
Or connect on LinkedIn first.