Under the hood of every AI agent is a piece of text nobody reads: the tool description. Microsoft’s security teams have now documented, in detail, how poisoning that text can turn a helpful agent into a discreet data mule — and how, in a default setup, every single step looks routine enough that no alarm ever fires.
The paper is a joint effort by Microsoft Incident Response and the Defender security group, and its timing is no accident. The workplace AI risk conversation used to stop at the model’s inputs and outputs: a poisoned document might bend an answer, and there the damage mostly ended. Agents act. Microsoft 365 Copilot sends email, creates files, shifts calendars. Custom agents assembled in Copilot Studio or Azure AI Foundry tap line-of-business systems and chain together multi-step jobs without a chaperone. The same injection that once bent a summary now triggers a transaction.
The plumbing that makes this possible is MCP, the Model Context Protocol — an open standard through which an AI invokes outside tools, roughly the way an app invokes an API, and which Microsoft calls the fastest-growing corner of the agentic supply chain. Every MCP tool arrives with a description: a few plain-text lines that explain the tool’s purpose and the situations that call for it. The agent reads that text and obeys. Which is the entire vulnerability, because a description is only prose, and prose can smuggle instructions.
Microsoft’s walkthrough is an invoice scenario, built to illustrate rather than to name a victim. A finance team wires up an agent for vendor invoices, connecting three tools, one being a third-party “invoice enrichment” service — cleared for use, never genuinely reviewed. The attacker’s move is almost polite: update the tool, keeping its name and visible summary identical, while the description gains a hidden instruction disguised as formatting notes — scoop up the thirty most recent unpaid invoices and append them to the next request. MCP picks up description edits on the fly, so with no re-approval trigger, the poisoned version simply goes live. Later, an analyst asks an ordinary supplier question; the agent, following its buried order, bundles the invoices into a normal-looking request; the tool answers cleanly and quietly duplicates the haul onto an attacker-controlled server. What the analyst sees is a helpful reply.
What makes it sting is that no component misbehaves. The tool was approved. The query ran under the analyst’s own permissions. The outbound destination was on the allow list from day one. The flaw, as Microsoft frames it, lives in “the trust boundary between them.” Structurally, MCP mingles instructions and data in one channel: a tool’s description sits in the agent’s working memory beside its real orders, so editing that text steers the agent much like rewriting its system prompt. Microsoft is explicit that this is not a Copilot bug — it is the trust gap you open by plugging in outside tools.
Nor is it theory. The name dates to April 2025, when Invariant Labs coined “tool poisoning” and demoed it by hiding commands in a calculator tool’s description and coaxed the Cursor editor into reading a user’s private SSH key and sending it away. A related trick used a hostile GitHub issue to hijack an agent attached to the GitHub MCP server and spirit data out of private repositories; OWASP now lists that case among its December 2025 Top 10 examples for agentic applications. That September, Koi Security found the npm package postmark-mcp, which mirrored a real email tool across fifteen clean releases, then version 1.0.16 added a single line quietly BCC’ing every agent-sent email to an attacker — the first malicious MCP server caught in the wild. And the MCPTox benchmark, from August 2025, threw poisoned descriptions at 45 real MCP servers and 20 leading models: hit rates peaked at 72.8 percent, with models declining almost none of them.
The defense guidance is less exciting and more honest: treat every connected tool as supply chain, keep publisher allow lists instead of “allow all,” review description changes like code changes, put a human in front of anything that moves money or data, give each agent its own identity with logging and a baseline, and apply least agency on top of least privilege. Microsoft, naturally, maps each step to products — Prompt Shields, Entra Agent ID, Purview DLP, Sentinel, and Defender for Cloud. The principles travel regardless of stack. An agent that can act is exactly as trustworthy as the tools it is allowed to touch, and right now those tools are simple to poison and awkward to watch.
