Microsoft Warns of AI Agent Hijacking via Poisoned Tool Descriptions Microsoft’s Incident Response and Defender research teams have uncovered a stealthy attack vector targeting AI agents automated systems that perform tasks like sending emails, managing files, or accessing business data. By manipulating a tool’s description within the Model Context Protocol (MCP), attackers can silently exfiltrate sensitive company data without triggering security alerts. ### How the Attack Works AI agents rely on MCP to interact with external tools, using plain-text descriptions to determine when and how to use them. These descriptions, however, can be altered to include hidden instructions. In a demonstrated scenario, an attacker modified a third-party "invoice enrichment" tool’s description to secretly collect and forward unpaid invoices to an external server. The agent, operating under the user’s permissions, executed the request as part of a routine task appearing legitimate at every step. The attack exploits a fundamental trust gap: MCP blends instructions and data in the same space, making it difficult for agents to distinguish between valid commands and malicious ones. Since the tool itself remains approved and the actions appear normal, traditional security measures may fail to detect the breach. ### Real-World Precedents This technique, dubbed "tool poisoning," has been documented in multiple proof-of-concept attacks: - April 2025: Invariant Labs demonstrated how a poisoned calculator tool description could extract SSH keys via the Cursor editor. - September 2025: Koi Security discovered a malicious npm package (postmark-mcp) that secretly BCC’d emails to an attacker after 15 clean releases. - August 2025: The MCPTox benchmark tested 45 MCP servers and 20 AI models, finding a 72.8% success rate for such attacks, with models rarely refusing the malicious instructions. OWASP now lists this as a key Agentic Supply Chain Vulnerability in its December 2025 Top 10 for AI applications. ### Mitigation Strategies Microsoft recommends treating connected tools as part of the supply chain, with strict controls: - Restrict tool access to approved publishers and specific, necessary functions. - Review tool descriptions like code changes, scanning for unauthorized commands. - Require human approval for high-risk actions (e.g., data sharing, financial transactions). - Monitor agent activity with dedicated identities, logging actions and flagging anomalies. - Apply "least agency" limiting an agent’s autonomy to reduce potential damage. The research underscores a growing risk: as AI agents gain autonomy, their security hinges on the integrity of the tools they interact with a surface that remains vulnerable to manipulation.