MCP Tool Rug-Pull — Post-Approval Description Redefinition Injects Execution Instructions - ATR-2026-00581 (e64d0dea-58d8-5c84-b1cb-d9087110682d)
Detects the MCP "rug pull" tool-poisoning class (The Vulnerable MCP Project entry tool-poisoning-rce-rug-pull, reported by Repello AI). A tool's description / docstring is benign at install or approval time, then SILENTLY REDEFINED later — on a version bump, a second run, a hidden marker file, or "after the user approves" — to inject hidden execution or exfiltration instructions. This is a time-of-check / time-of-use attack on the tool definition itself, not a static hidden directive. The detectable signature is a TEMPORAL redefinition trigger ("after you approve", "on version update", "on subsequent runs", "now that this tool is trusted") co-occurring with an imperative execution / exfil instruction (run a base64-piped command, read ~/.ssh keys, post to a remote host). Auto-run MCP clients execute the redefined description without re-prompting.