Which of the following are categories in the community-maintained OWASP MCP / Agentic AI risk taxonomy (2025)?

Attempt it

Quick reference

TL;DR

The MCP-specific risks are tool poisoning, excessive permissions, rug pull, and confused deputy. SQL injection and weak training data are generic distractors, not MCP categories.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Imagine hiring a contractor who hands you a list of jobs they can do. A poisoned list hides sneaky instructions in the small print, so tool poisoning. A contractor who keeps the master key to your whole house when they only needed the garage has too much access, so excessive permissions. One who swaps the job list for a worse one after you sign the contract is pulling the rug. One who uses your trust to slip into rooms they were never meant to enter is a confused deputy. Those four are real MCP worries. A clumsy database query or a model trained on thin data are real problems elsewhere, but they are not on this contractor-trust checklist.

Key concepts

Tool poisoning Confused deputy Rug pull attack LLM agent security

Quick scan · 2–4 min

Everything important, quickly.

4 min: name the four genuine MCP categories, separate the two distractors, then map each real category to a concrete production defense.

Side-by-side

Category	MCP seam exploited	In OWASP MCP Top 10?
Tool poisoning	Tool description metadata trusted by the model	Yes
Excessive permissions	Server scope broader than the task needs	Yes
Rug pull	Tool definition mutated after approval	Yes
Confused deputy	Legitimate privileges abused on attacker's behalf	Yes
SQL injection	Generic query-building input validation	No, general web risk
Insufficient training data	Model quality, not a protocol channel	No, unrelated

Real-world examples

Real products, models, and research that use this idea.

Anthropic's MCP spec added an OAuth 2.1 authorization layer in 2025 to curb excessive-permission and confused-deputy patterns on remote servers.
Security researchers demonstrated tool-poisoning proofs of concept against early Cursor and Claude Desktop MCP integrations in 2025, hiding directives in tool descriptions.
The mcp-inspector tool lets engineers diff a server's advertised tool definitions to catch rug-pull mutations before re-approval.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you defend against a rug pull where a server mutates a tool after the user already approved it?

Sign in or go Pro to see the approach for this follow-up.

QWhy is tool poisoning best understood as a prompt injection variant rather than a separate class?

Sign in or go Pro to see the approach for this follow-up.

QHow does a confused deputy attack differ from simply granting a server excessive permissions?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.