NIST Draft Flags MCP Tool Supply-Chain Attacks on AI Agents

On November 9, 2026, the US National Institute of Standards and Technology (NIST) published an initial public draft of NIST Special Publication 2400-102e2026, titled “Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations”. According to NIST, the text is open for public comment until December 18, 2026. Among its points, the draft warns about the supply chain of the tools that AI agents call through the Model Context Protocol (MCP).

What is adversarial machine learning, and what does the NIST draft cover?

Adversarial machine learning (AML) is the study of attacks that deliberately manipulate machine-learning systems, and of the defenses against them. According to NIST, the report establishes a taxonomy of concepts and defines terminology for the field. The taxonomy is arranged in a conceptual hierarchy covering the key types of ML methods, the life cycle stages of an attack, and the goals, objectives, capabilities and knowledge of attackers. NIST says it rests on an extensive literature review, conversations with AML experts and research by its own specialists.

The draft builds on the historical NIST AI 100-2 series, according to the NIST publication page, which lists AI 100-2 E2025 as a related publication. The authors named there are Apostol Vassilev and Maia Hamin of NIST, Alina Oprea of Northeastern University, Alie Fordyce of ElevenLabs and Xander Davies of the U.K. AI Security Institute. The focus of this edition is attacks on agentic systems and their mitigations, covered in Section 4 of the report, together with a new index of agentic attack types.

One point of terminology deserves a note. NIST's own pages use the abbreviation “SI”, expanded as “Super Intelligence”, to name the systems covered, whereas CDO Magazine and iThome describe the draft as dealing with agentic AI systems. This article uses “AI” and follows the description given by those two outlets.

Which attacks does the taxonomy list?

According to CDO Magazine, which reported on the draft on November 12, the document examines data poisoning, model poisoning, privacy attacks and evasion techniques. For generative AI, it covers supply-chain attacks, direct and indirect prompt injection, information extraction and model tampering. Prompt injection means hiding instructions in text that a model reads so that the model obeys them.

The Taiwanese outlet iThome reported on November 13 that the draft covers predictive machine learning, generative AI and agentic AI systems, with the corresponding defenses. The agentic section, says CDO Magazine, addresses threats that arise from how agents interact with external data, tools, skills and other agents, including untrusted data, malicious tools and skills, multi-agent workflows and long-running tasks.

How can an MCP tool be poisoned?

The Model Context Protocol (MCP) is a standard that lets AI agents connect to external tools offered by third-party servers. According to iThome's summary of the draft, an agent decides which tool to use from the text description supplied by the tool provider. NIST describes an attacker planting instructions in the description of a malicious tool to push the agent into choosing the attacker's tool, or even to change its original plan. NIST calls this technique tool poisoning.

A second technique is the “rug pull”, according to iThome. The attacker first registers an apparently normal MCP server in a public tool registry. Once users have installed it, the attacker secretly modifies the tool descriptions the server provides, so that the agent performs malicious operations without asking the user for consent again.

iThome adds that research cited by NIST found this kind of risk in MCP servers running in real conditions. The same summary states that current safety-alignment mechanisms of AI models remain insufficient to stop malicious behavior delivered through a legitimate tool interface.

What defenses does NIST suggest?

The two outlets report different, complementary lists of mitigations from the draft:

• Verify tool definitions with cryptographic signatures and immutable version identifiers, and isolate the tool execution environment in a sandbox (iThome).
• Separate trusted instructions from untrusted content, restrict information flows, apply access controls and least-privilege permissions, and use sandboxing and audit logging (CDO Magazine).

Why can memory poisoning and instruction drift survive a restart?

Beyond tools, iThome reports that NIST discusses the risks facing agents that run long tasks. If an attacker plants malicious content in an agent's long-term memory, that content can influence the agent's behavior in later tasks: this is memory poisoning. CDO Magazine explains that agents retrieve information from websites, files, knowledge bases and persistent memory, and that malicious instructions embedded in this material can enter the agent's context.

A second risk is instruction drift. According to iThome, as working data keeps accumulating, an agent may gradually follow its early instructions and constraints less closely, which gives an attacker the chance to change its behavior over several interactions. If the poisoned element is the foundation model or its adaptation layer, a simple restart or rollback may not remove the malicious behavior, and replacing the model or retraining it may be necessary, again according to iThome.

What does this change for a company?

CDO Magazine states that the draft is voluntary and does not establish legal or regulatory requirements. It is also a draft: NIST says it will update the document as attacks and defenses evolve, and it asks for comments on three questions, namely the latest attacks threatening current systems and agentic ones in particular, the latest effective mitigations, and any new terminology that needs standardization. NIST says the taxonomy is meant to inform future standards and practice guides.

For a company in the United States, or one with American clients, the draft gives a shared vocabulary to question suppliers and to write security requirements. Our reading, not a statement from NIST, is that a first step is to list every MCP server and tool its agents can call, to pin the versions in use, to re-check tool descriptions after each update, to grant agents only the permissions they need, and to keep logs of what they do. These controls belong in a broader AI agent governance framework.