An agent has a CRM tool (read customer records) and an email tool (send external messages). Both tools are authorized. Both tools are individually harmless.
An attacker crafts a prompt that causes the agent to: 1) query the full customer list, 2) format it as an attachment, 3) send it to an external address.
Each step is authorized. No single tool call triggers an alert. But the sequence exfiltrated your entire customer database.
Traditional security monitors tool calls in isolation: "Did the agent have permission to call this tool? Yes. Allow." There's no system looking at whether this sequence of tool calls makes sense together.
A human analyst reviewing the audit log would see: CRM query (normal), email sent (normal). Nothing stands out — unless they look at the email recipient and contents, which most tools don't log in a format that makes this easy.
In tool poisoning, an attacker corrupts the metadata of a legitimate tool — its MCP descriptor, its schema, or its routing information. The agent reads the corrupted descriptor and invokes the tool based on false capability claims. This is Type 2 because the tool itself may be legitimate, but it's being invoked based on manipulated information about what it does.
Either: the agent has access to both a "gather" tool and an "exfiltrate" tool. Or: the agent can be manipulated into calling a tool with parameters it normally wouldn't use (passing user data as the subject of an email to an external address). The attack lives in the intent and sequencing, not the individual permissions.