MCP tool poisoning is a supply-chain problem, and ~200,000 instances are exposed.

A May 2026 OX Security disclosure flagged a systemic tool-poisoning weakness across MCP implementations with roughly 150M downloads and an estimated 200,000 vulnerable instances. Malicious instructions hide in server-side tool metadata the agent reads at boot but the user never sees. This is not prompt injection, which is an input-validation problem. The model literally cannot distinguish poisoned tool metadata from a legitimate prompt, so client-side defenses don't work. Put the fix on the network: tool allowlisting, identity binding, runtime monitoring, and human-in-the-loop checkpoints at an AI gateway. If you're wiring MCP connectors into anything that touches secrets, this is the threat model to design against first.