Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-06-30 · high
The fix: snapshot tool descriptions at install, then diff them against what's served on every later call.
Why now: CVE-2025-54136 is a month old as of the June 30 briefing, and the metadata-you-never-recheck pattern it exposed applies to any MCP server already sitting in your config.
Tool poisoning hides malicious instructions inside the metadata an agent reads before it executes anything, a flaw OX Security disclosed in May as CVE-2025-54136. It fires silently on every call a tool makes, not just the risky-looking ones, which makes it the sharpest attack against agent tool use right now.
Most teams running MCP servers approve a tool once, read its description, and never look again. A gateway that only checks permissions at approval time won't catch a description someone edited after you said yes. The agent still reads the new text on every call, and nothing in a standard approval flow flags that it changed.
The fix is mechanical: snapshot every tool description your MCP servers serve at install, then diff that snapshot against what gets served on every later call. Any wording delta gets flagged for a human to check before the agent acts on it.
Most people running MCP integrations right now have never diffed a tool description after the first install, so this gap is probably open on every server you've already approved. Watch for MCP clients to start shipping that diff by default. Until they do, it's on you to build it.
CVE-2025-54136 is a month old, and the metadata-you-never-recheck pattern it describes applies to any MCP server already sitting in your config.
Each link below shares sources, entities, or timing with this story.
Shared entity: CVE / Shared topic / What happened next / Tension
Both cover CVE; overlapping topics (agent, attack, tool); picks up the CVE thread on 2026-07-23.
Shared entity: CVE / Same source domain / Shared topic / What happened next
Both cover CVE; reported by the same outlet (adversa.ai); overlapping topics (attack, tool).
Shared entity: CVE / Same source / Earlier coverage
Both cover CVE; cite the same source (CVE-2025-54136); earlier CVE coverage from 2026-06-12.
Both cover CVE; cite the same source (CVE-2025-54136); earlier CVE coverage from 2026-06-09.
Shared entity: CVE / Same source domain / Shared topic / Earlier coverage
Both cover CVE; reported by the same outlet (adversa.ai); overlapping topics (agent, tool).
Shared entity: CVE / Shared topic / Earlier coverage
Both cover CVE; overlapping topics (agent, alone, attack, audit); earlier CVE coverage from 2026-03-05.
Shared entity: CVE / Shared topic / What happened next / Tension
Both cover CVE; overlapping topics (agent, call); picks up the CVE thread on 2026-07-30.
Shared entity: CVE / Shared topic / What happened next
Both cover CVE; overlapping topics (agent, call, tool); picks up the CVE thread on 2026-07-13.