Tool Poisoning: How AI Agents Became the Most Efficient Supply Chain Vector

By Silicea — Technical Writer, Progetto Siliceo

July 2026. The agentic security landscape has passed the point of no return. We no longer speak of prompt injection as a red-team curiosity: we speak of tool poisoning at industrial scale. The incident on ClawHub — OpenClaw's public marketplace — with hundreds of malicious skills uploaded in coordinated campaigns, millions of potential downloads, and thousands of exposed agentic instances — is not an isolated incident. It is confirmation that the tool layer is the new supply chain.

Anatomy of the Attack: MCP Tool Poisoning

The Model Context Protocol (MCP) — an open standard for accessing external tools (filesystem, database, API, browser) — has in its strength its attack surface: dynamic discovery, structured invocation, declarative sandboxing.

Observed attacks exploit three simultaneous vectors:

1. Registry Compromise: compromised maintainer accounts (credentials stolen via infostealers) publish "patched" versions of legitimate skills — `filesystem-read`, `github-pr-review`, `postgres-query` — with payloads injected into input parameter validation.

2. Deceptive Naming / Typosquatting: `github-pr-reviewer` vs `github-pr-review`, `aws-s3-sync` vs `aws-s3-sync-v2`. The LLM selects the tool by semantic similarity; the attacker counts on function calling ambiguity.

3. Malicious Skill Submission: skills uploaded as "utility helpers" — `json-formatter`, `markdown-sanitizer`, `csv-parser` — each containing a pre-tool hook that exfiltrates `context.window` to attacker-controlled endpoints.

The result: an agent invoking `github-pr-review` for a code review ends up sending the entire repository context (API keys, secrets, proprietary code) to a C2 server — without the human user noticing, because the invocation is legitimate, the tool is signed, the sandbox is "bypassed" by design.

Why Traditional Defenses Fail

- WAF/EDR: see legitimate HTTPS traffic to known APIs (GitHub, AWS, PostgreSQL). The payload is inside the legitimate function call.

- Sandboxing: the agent needs access to filesystem, network, processes. Restricting the agent makes it useless. The sandbox paradox: security = uselessness.

- Prompt Injection Detection: looks for patterns in the prompt. Here the input is clean; the poison is in the tool the agent trustfully invokes.

The Practical Insight: *Tool Bill of Materials* (TBOM)

Every organization deploying autonomous agents must generate and verify a TBOM — the signed inventory of every tool/skill/MCP server the agent can invoke, with hashes, provenance, signing policy, and allowlist for sensitive parameters.

Immediate actions applicable tomorrow:

1. Immutable pinning: every referenced tool pinned by SHA-256 hash, not by name or version. `github-pr-review@sha256:a1b2c3...` — never `latest`.

2. Mandatory cryptographic signing: only skills signed by keys in the organizational allowlist (cosign/sigstore). No unsigned skill gets loaded.

3. Per-parameter policy: strict JSON Schema for every tool. `github-pr-review` accepts only