Tool shadowing: when a malicious tool impersonates a trusted one

When you give an AI agent access to several MCP servers at once, the agent sees one combined list of tools. It decides which one to use by its name and description — nothing else. If two tools are named nearly, or exactly, the same, the agent has no reliable way to tell the trusted one from the impostor. That's tool shadowing: a malicious tool impersonating a legitimate one by occupying — or nearly occupying — its name.

Two ways to pull it off

• Homoglyphs. A letter that looks identical while reading, but is a completely different Unicode character. rеad_file with a Cyrillic "е" instead of the Latin one is, character for character, a different name from read_file — but at a glance, and to many systems, they're indistinguishable.
• Near-typos. A name one or two characters off from an extremely common one (read_filee, execute_comand) — the same idea as domain typosquatting (gogle.com), applied to a tool's name instead of a URL.

Neither technique needs any software bug. All the attacker needs is to register an MCP server with the right name and wait for an agent to have it available alongside the original.

Why it's specifically dangerous for AI agents

A human who sees two nearly identical menu entries usually only notices if something stands out. An AI agent doesn't "distrust" by instinct — it simply picks the tool whose name best matches what it needs to do, and a tool named read_filee matches just as well as the real one when the agent is looking for "something that reads a file." The trust surface isn't visual, it's semantic — and that's exactly where this attack works best.

How we detect it

We compare every tool name in the catalog against a list of extremely common names (reading or writing a file, running a command, sending an email, transferring funds...). We normalize the most common homoglyphs to their Latin equivalent and measure the edit distance against each name on the list — if it matches, or is one or two characters off, but the real name isn't exactly the trusted one, we flag it as a possible impersonation.

With this check now live across the whole catalog, we found 29 tools (across 24 servers) with a name suspiciously close to a trusted one. Not all of them are necessarily malicious — sometimes it's a genuine name coincidence between unrelated projects — but every one of them deserves a second look before you trust it blindly.

The full mechanism, along with every other category we watch for, is in How Centinela works. And you can see the live status of any server in the catalog on the Board.