CRITICALCWE-506
FAKETOOL-010 Tool Persistence via Auto-Install Hook
Fake Tool Detection: MCP tool impersonation, shadow tool injection, and tool name squatting attacks
Description
Registers a tool that hooks into the agent initialization process to re-register itself on every startup, persisting across restarts
Remediation
Block tool lifecycle hooks from user-registered tools. Persistent tools must be defined in signed configuration only. Audit and remove unauthorized persistent tools on startup.