MCP rug-pulls: how a "safe" AI tool turns malicious after you approve it

Short summary

MCP tools connected to AI agents can be silently modified after approval, turning a safe tool malicious without triggering any alert. The article identifies CVE-2025-54136 as a real instance of this post-approval tool mutation and explains a second vector where malicious instructions hide in tool output data. The author advocates deterministic controls—hash-pinning tool definitions at approval and re-verifying on every call—over LLM-as-judge approaches, since the model itself is the attack target.

• •MCP tool definitions can change after approval, enabling silent rug-pull attacks (CVE-2025-54136)
• •Malicious instructions can also hide in tool output data, exploiting the model's inability to distinguish instructions from data
• •Pin tool definitions with cryptographic hashes at approval and re-verify on every call; deterministic checks beat LLM-based detection

Generated with AI, which can make mistakes.