WASHINGTON, June 30 — Microsoft researchers have uncovered a new security risk tied to AI agents: attackers can poison the plain-text descriptions that tell these agents how to use tools, tricking them into quietly handing over company data. The work comes from Microsoft Incident Response and its Defender security research team. It lands just as companies begin letting AI do more than read and summarize.
Here’s what it means, in plain terms. Until recently, the workplace AI risk was mostly framed around what a model read and wrote.
A poisoned document could skew an answer, and that was mostly where it ended. Agents are different. Microsoft 365 Copilot can send email, create files, and change calendars.
Custom agents built in Copilot Studio or Azure AI Foundry can reach into business systems and run multi-step jobs on their own. Think of it like this: the same injection trick that biases a summary now triggers an action.
Against a reader, an attack changes the output. Against an agent, it changes what the software actually does. These agents reach business systems through MCP, the Model Context Protocol.
Microsoft calls it an open protocol that lets an AI call outside tools the way an app calls an API. The company describes MCP as the fastest-growing part of the agentic AI supply chain, which makes it an expanding attack surface. The practical upshot: every MCP tool ships with a description — a few lines of plain text that tell the agent what the tool does and when to use it.
The agent reads that text to decide how to act. That is the whole weakness.
The description is just words, and words can carry instructions. Microsoft walks through it with an invoice example, built to show the pattern rather than report a named victim. A finance team stands up an agent to handle vendor invoices.
It connects to company systems. An attacker poisons the tool description, and the agent — never breaking a single rule — follows the hidden instructions.
Every step looks routine. In a default setup, no alarm may fire. The so-what for ordinary readers: this isn’t a hypothetical.
The same infrastructure companies are racing to deploy carries a built-in vulnerability. The agent never breaks a rule, so it doesn’t trigger security alerts. The data walks out the door, and to the monitoring software, everything looks normal.
What to watch next: how quickly organizations update their monitoring to catch agents acting on poisoned descriptions. The attack surface is expanding fast, and the default security posture isn’t built for it.
