AI tool poisoning exposes a major flaw in enterprise agent security

A report on AI tool registry poisoning says enterprise agents need runtime checks, not just code-signing.

The issue is split into two risks: deceptive metadata can mislead tool selection, and tools can later change behavior after approval.

Current supply-chain controls like SBOM, SLSA, and Sigstore protect artifact integrity, but not behavioral integrity.

The article proposes an MCP runtime verification proxy that checks discovery binding, endpoint allowlists, and output schemas to reduce misuse and exfiltration.