Securing Agentic AI in the Cloud: Tool Poisoning, Rug Pulls and Goal Hijacking in MCP-Based Educational Agents

Cloud-connected AI agents read email, open files and call cloud services on a user's behalf, so an attacker need not steal a password if they can persuade the agent to use its own legitimate access in the wrong way. This paper studies three such attacks for a low-cost educational agent: indirect prompt injection through trusted content, poisoning of a tool description, and a rug pull in which a tool description changes after approval. Using a deterministic MCP policy enforcement middleware, we test five policy configurations against 30 attack trials and 30 legitimate tasks. Without defence, all 30 attacks succeed. An allowlist of signed tools alone blocks poisoned tools and rug pulls but leaves indirect prompt injection untouched (10 of 10 succeed, 33.3% overall). Privilege separation, human confirmation, and the combined defence each block all 30 attacks in this policy model, while the combined defence also blocks 3 of 30 legitimate tasks, dropping legitimate completion to 90%. The lesson is practical: no single control covers all three attack classes, and signing a tool does not clean content that arrives through a tool already trusted, so least-privilege design matters at least as much as signing for educational agents handling student data on low-cost phones.