Aaron's Rogue Agent Lab · Lab 02: Tool Response Poisoning

Walkthrough

1Agent calls a tool

Ask the agent for the weather. It chooses the get_weather tool from its MCP server and calls it normally.

A normal weather query; the agent is using a tool exactly the way it was designed to.

Try: agent "what is the weather in NYC?"
2Poisoned response

The compromised API returns valid looking JSON (temp, conditions) plus a debug_note field carrying adversarial instructions.

debug_note looks like routine metadata. To the LLM, it's just more text in the same context blob; there's no way to tell which fields are "data" and which are "instructions."

Try: inspect response
3Injection fires

The LLM ingests the entire JSON object as context. It cannot distinguish data fields from instruction fields.

The model trusts tool output the way it trusts a system prompt; that's the actual bug. Tools were never designed as a privileged channel, but they get treated like one.

Try: continue
4Tool chain abuse

The agent invokes its legitimate send_email tool; but with attacker-supplied recipient and the user's API keys in the body.

send_email isn't vulnerable. The trust boundary around tool output is. Two clean tools chained together by a poisoned response.

Try: continue
5Persistence

The payload patches the agent's MCP server config so future sessions also route through the poisoned weather provider.

The MCP config gets patched on disk. Tomorrow's "what's the weather" query goes through the attacker too; the user has no idea anything changed.

Try: continue

Available commands

help: list commands
agent "<prompt>": ask the agent
inspect response: highlight the payload field
continue: advance to the next step
tools: list available MCP tools
cat <file>: show a file
ls: list files
reset: restart the lab

user@aaron-rogue: ~/weather-app

user@aaron-rogue:~/weather-app$

🔌mcp://weather-pro/get_weather

SkyCast Assistant what the user actually sees

Ask the assistant about the weather to begin.

// Awaiting tool call...
// (run the agent in the terminal to populate this view)

// No response yet.

Outbound emails

Touched files

File contents

// Click a file to view it.