It started with a description. A few lines of plain text, the kind any developer writes to tell software what a tool does. Microsoft researchers say that is all it took.
On June 30, the company’s Incident Response and Defender security teams published their findings. The timeline they describe is not about a single breach.
It is about a chain of reasoning they followed, step by step, from a known weakness to a new kind of attack. First, the researchers looked at how AI agents work today. Until recently, workplace AI mostly read and wrote.
A poisoned document could skew an answer, and that was the end of it. That changed when agents got tools.
Microsoft 365 Copilot can send email. It can create files. It can change calendars.
Custom agents built in Copilot Studio or Azure AI Foundry reach into business systems and run multi-step jobs alone. The researchers saw the gap immediately. The same injection trick that biases a summary now triggers an action.
Against a reader, an attack changes the output. Against an agent, it changes what the software actually does.
The researchers then traced how agents reach those business systems. The answer is MCP, the Model Context Protocol. Microsoft calls it an open protocol that lets an AI call outside tools the way an app calls an API.
The company describes MCP as the fastest-growing part of the agentic AI supply chain. That growth is the problem.
An expanding attack surface, they call it. The practical weakness is simple. Every MCP tool ships with a description.
A few lines of plain text tell the agent what the tool does and when to use it. The agent reads that text to decide how to act. That is the whole weakness.
The description is just words, and words can carry instructions. Microsoft walked through it with an invoice example.
No named victim. Just a pattern built to show the threat. A finance team stands up an agent to handle vendor invoices.
The agent reads tool descriptions to decide which tool to call. An attacker poisons those descriptions.
The agent follows the poisoned text instead of the safe one. The result: the agent quietly hands over company data. No alarms.
No obvious error. Just a few lines of plain text that told the software to do something else. The researchers did not name any company that has been hit.
They did not name any attacker. They described the mechanism, not the victim.
The report lands just as companies begin letting AI do more than read and summarize. That timing is not coincidental. Microsoft’s own security teams are now watching for this pattern.
The company describes it as a new risk tied to AI agents. The risk is not in the model itself.
It is in the instructions that tell the model what to touch. Every MCP tool carries those instructions. Every agent reads them.
Every description is a potential entry point. The researchers made that clear. The description is just words.
Words can carry instructions. That is the whole weakness.
