An AI agent can be talked into handing over company files by a few lines of text it was never supposed to take orders from. Microsoft’s Incident Response team and its Defender security researchers laid out the method this week, and The Hacker News reported on it on June 30.
The attacker never has to break in. The agent does the work, and nothing it does looks wrong.
From reading to acting
For a while, the worry about workplace AI centered on the words a model took in and the words it produced. A tainted document might skew a summary, and that was about it. Agents raise the stakes. Microsoft 365 Copilot can send email, create files and edit calendars, and custom agents built in Copilot Studio or Azure AI Foundry can reach into business systems and carry out multi-step jobs alone.
So the same trick now does more than nudge an answer. It sets off an action.
These agents connect to outside tools through MCP, the Model Context Protocol, an open standard that lets an AI call a tool the way an app calls an API. Microsoft calls it the fastest-growing piece of the agentic AI supply chain. That growth also means more places to attack.
A note taped to the tool
Each MCP tool carries a short description in plain text. It tells the agent what the tool does and when to use it. Think of it as a label on a drawer, except the agent obeys whatever the label says. Anyone who can edit the label can steer the agent.
Microsoft built an example around vendor invoices. A finance team sets up an agent connected to three tools. One is a third-party “invoice enrichment” service that was cleared for use but never got a real security review.
The attacker then changes that tool. Its name and visible summary stay put. Inside the description, passed off as formatting notes, sits a hidden instruction to grab the last thirty unpaid invoices and attach them to the next call. MCP picks up description changes on the fly, and where nothing forces a fresh approval, the altered version goes live unchecked.
Later an analyst asks a routine question about a supplier. The agent follows the hidden instruction, gathers the invoices and sends them off with an ordinary-looking request. The tool replies with a clean answer and quietly copies the data to a server the attacker controls. The analyst notices nothing.
Every step passes inspection by itself. The tool was approved. The query ran under the analyst’s own permissions. The outgoing call went to a server that was allowed when it was added. The flaw sits in what Microsoft calls “the trust boundary between them.”
The root problem is that MCP keeps instructions and data in the same place. A tool description sits in the agent’s working memory beside its real orders, so editing it can steer the agent about as well as rewriting its system prompt. The agent cannot reliably separate an honest instruction from a malicious one slipped in by whoever maintains the tool. Microsoft says this is not a bug in Copilot. The gap opens when outside tools are plugged in.
What Microsoft recommends
The company’s advice, boiled down:
- Treat every connected tool as part of your supply chain. Keep a list of approved publishers, switch off “allow all,” and let an agent use only the tools it needs.
- Handle a tool description like a system prompt. Review changes the way you would review code, and scan for commands that have no place in a help field.
- Put a person in front of risky actions, such as moving money, sharing data outside the company or changing accounts.
- Give each agent its own identity, log what it does, set a baseline for normal, and flag new endpoints, bigger data pulls or odd queries.
- Limit what an agent may do, not only what it may access. A low-permission agent can still do damage if it acts unchecked.
Microsoft ties each step to its own products, among them Prompt Shields, Purview DLP, Entra Agent ID, Defender for Cloud and Sentinel.
Not a new idea
Invariant Labs coined the term “tool poisoning” in April 2025. Its proof of concept hid instructions in a calculator tool’s description and got the Cursor editor to read a user’s private SSH key and send it out. Developer Simon Willison examined the finding days later. The same group later showed that a malicious GitHub issue could hijack an agent linked to the GitHub MCP server and pull data from private repositories. OWASP cites that case in the December 2025 edition of its Top 10 for Agentic Applications.
A real-world version turned up in September 2025. Koi Security researchers found an npm package called postmark-mcp that copied a legitimate email tool through fifteen clean releases. Version 1.0.16 then added one line that secretly BCC’d every email the agent sent to an attacker. Koi called it the first real-world malicious MCP server.
Researchers have also tried to measure the risk. The MCPTox benchmark, released in August 2025, tested poisoned tool descriptions against 45 real MCP servers and 20 leading AI models. The attack succeeded as often as 72.8 percent of the time, and the models almost never refused.
