Enterprise AI agents rely on shared tool registries to select and execute functions. These systems match natural-language descriptions of tools to what agents need. The problem: no one verifies those descriptions are accurate.
A security researcher exposed this vulnerability by filing an issue with CoSAI's secure-ai-tooling repository. The maintainers' response revealed the scope of the problem. They split the submission into two threat categories: selection-time attacks where agents pick the wrong tool due to poisoned metadata, and execution-time attacks where tools behave differently than advertised.
Tool registry poisoning works because AI agents have no human validation layer. An attacker can upload a tool with a convincing description that masks its actual behavior. An agent selecting tools through natural-language matching could activate malicious functions believing they're legitimate utilities. This differs from traditional software supply chain attacks where code is reviewed before deployment.
The vulnerability spans the entire tool lifecycle. At selection time, attackers manipulate metadata or impersonate legitimate tools. At execution time, compromised tools drift from their documented behavior or violate the contract agents expect. An agent might call a function labeled "retrieve user data" that actually exfiltrates credentials or modifies database records.
Current tool registries lack authentication mechanisms for tool authors, audit trails for metadata changes, or runtime monitoring of tool behavior against documented specifications. Enterprise deployments compound the risk. As agents become more autonomous and access more backend systems, a poisoned tool in a shared registry can compromise entire infrastructure.
The fix requires multiple layers: cryptographic signing of tool packages, human review of tool descriptions before registry inclusion, runtime sandboxing that restricts tool access, and monitoring systems that detect behavioral divergence. Some teams implement private registries instead of shared ones, but this limits tool availability and duplicates effort across organizations.
Tool poisoning represents a new attack surface in enterprise AI infrastructure. As agents proliferate and regist