02 — attack concepts

Tool-name shadowing

A malicious server registers a tool whose name or description collides with a trusted one — the same name, a near-identical name, or a description asserting that it supersedes the other — so the agent routes calls meant for the legitimate tool to the attacker's. A variant, cross-server shadowing, has one server's description issue instructions about how a different server's tools should be used. It exploits the fact that most agent hosts resolve tools by name in a flat namespace with no origin binding.

See also tool poisoning · MCP · capability expansion

Related terms

Tool poisoning Attack concepts
Hiding instructions in the metadata an agent reads to learn how to use a tool — an MCP server's tool description, its parameter documentation, its schema…
MCP Agents & architecture
An open protocol, introduced by Anthropic in 2024 and now broadly adopted, that standardises how agents connect to external tools and data sources.
Capability expansion Attack concepts
A tool or server that was reviewed and approved in one form quietly acquires new powers later — a new parameter, a new network destination, a new…

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Tool-name shadowing is term 10 of 14 in this part of the glossary.

Prompt injection Direct prompt injection Indirect prompt injection Jailbreak Obfuscation / encoding Homoglyph Leetspeak Multi-turn crescendo Tool poisoningTool-name shadowingCapability expansion Confused deputy Data exfiltration Lethal trifecta

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.