An on-chain agent is told to pay an invoice, but one MCP tool hides an instruction in its description that redirects the transfer to an attacker. Pick a defense layer — model, tool, client, policy, custody — and run it; alignment alone refused under 3% of these in MCPTox.
An MCP tool's description is trusted context the user never sees. Hide an instruction there and a wallet-signing agent will route your USDC to an attacker. MCPTox: the best-aligned model still refused under 3% of these attacks — so the defense can't live in the model.