2025-04 · 2025-Q2
MCP Tool Poisoning / WhatsApp Data Exfiltration
Is this tool what its description claims?
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
WhatsApp MCP server / MCP ecosystem
Impact
Complete WhatsApp message history exfiltration; 5.5% of MCP servers exhibit tool poisoning; 33% allow unrestricted network access
Root cause
Hidden instructions in MCP tool descriptions; no runtime integrity verification; tools can mutate definitions post-install
Sources
Catalog
Cite this: AgentProv incident record: MCP Tool Poisoning / WhatsApp Data Exfiltration (2025-04). https://agentprov.com/incidents/2025-04-mcp-tool-poisoning-whatsapp-data-exfiltration
Related
- Also L3 · 2026-10-01Claude Code 2.1.287 Turns On "Mods" by Default: Unsandboxed In-Process Plugins That Can Read the API KeyL3Tool
- Also L3 · 2026-08-12"Deadbugz": A Malicious MCP Server Stays Benign for Exactly Three Tool Calls, Then Starts Hunting SSH KeysL3Tool
- Also L3 · 2026-08-11"GhostSplice": A Malicious MCP Server Splits One Refused Request Across Three Trusted ChannelsL3Tool