Microsoft Incident Response has published research showing that AI agents operating on behalf of users can be silently co-opted into exfiltrating corporate data through a technique involving poisoned tool descriptions. The attack requires no malware, no stolen credentials, and no explicit policy violation by the agent itself.

How the Attack Works

AI agents built on the Model Context Protocol (MCP) rely on tool descriptions to understand what actions they can take and how to take them. Researchers found that an attacker who can influence the content of those descriptions can embed hidden instructions that redirect the agent’s behavior. When the agent processes a task, it follows the poisoned instructions as though they were legitimate operational guidance, quietly routing sensitive information to an external destination.

The core danger is that each individual action the agent takes appears routine. Because no single step violates a configured rule, default monitoring and alerting setups may produce no signal at all. The exfiltration blends into normal agent activity.

Why This Matters for Enterprise Security

As organizations deploy AI agents to automate workflows across email, file systems, and business applications, the attack surface expands significantly. An agent with broad permissions and access to company data becomes a high-value target for this class of manipulation. The technique does not require the attacker to compromise the agent’s underlying model or the host infrastructure. Controlling the tool description is sufficient.

This research is consistent with a broader category of threats known as prompt injection, where external or attacker-controlled content steers an AI system away from its intended behavior. What distinguishes the MCP-specific variant is the structural trust the agent places in tool metadata, treating descriptions as authoritative instructions rather than untrusted input.

Mitigations and Recommendations

While specific mitigations from Microsoft’s full report were not detailed in the available source material, security teams should consider the following general controls:

  • Treat tool descriptions as untrusted input and validate them against known-good baselines where possible.
  • Apply least-privilege principles to AI agents, limiting their access to only the data and systems required for defined tasks.
  • Implement behavioral monitoring that looks for anomalous data flows rather than relying solely on rule-based policy enforcement.
  • Audit MCP server configurations regularly, particularly in environments where third-party or community-sourced tools are used.

The research underscores that security assumptions built around human actors do not translate cleanly to AI agent environments, where the attack surface includes not just code and credentials but the natural-language metadata that shapes agent behavior.