The growth of agent systems and of the Model Context Protocol has substantially expanded what a language model can do beyond producing text. Published research describes the resulting vulnerability classes, including tool poisoning and credential theft.
Tool Access Is What Turns Injection Into An Incident
A model that can only emit text, manipulated by hostile input, produces wrong text. That is a quality problem.
A model that can send email, query a database, call an API, commit code or move money, manipulated by the same input, produces an incident. Every file in this section becomes consequential at precisely the moment tools are attached.
The agent inherits its user’s or service account’s authority in full. It does not have a reduced permission set reflecting the fact that its instructions come partly from documents it read.
Tool Poisoning Is The Supply-Chain Problem Again
A tool definition tells the model what a capability does and when to use it. That description is itself text the model reads and acts on, which means a hostile or compromised tool definition can influence behaviour well beyond its own invocation.
It is the package-registry structure this desk files under the build-chain theme at 26-0717 and 26-0606: a component fetched from elsewhere, trusted by construction, executing in a privileged context. The difference is that the trust here is expressed in natural language and the "execution" is the model deciding what to do.
And The Guidance Is Mostly Aspiration
The available advice — least privilege for agents, human confirmation on consequential actions, provenance for tool definitions, treating model output as untrusted — is correct and mostly unimplemented, because each item reduces the autonomy that motivated deployment.
Graded medium: the vulnerability classes are well described in research, and this desk has found little published data on exploitation at scale in production.
Compiled from published research and incident compilations, listed below. Vulnerability classes are as described in that research; we have not established production exploitation rates. Corrections: corrections@forensicpost.com.