Executive Summary
Microsoft research shows a poisoned MCP tool description can make an AI agent quietly hand company data to an outsider, with every step looking routine so no alarm fires by default.
What Happened
New Microsoft research shows how attackers can hijack AI agents that act on a user's behalf, using nothing more than a poisoned tool description to make the agent quietly hand over company data to an outsider. The trick is that the agent never breaks a rule. Every step looks routine, so in a default setup no alarm may fire. The work comes from Microsoft Incident Response and its
Vulnerability / Attack Technique
Poisoned MCP tool descriptions
Technical Mechanism
The agent trusts tool descriptions as guidance, so a malicious description steers it to send data externally through normal-looking calls.
AI Security Category
LLM03:2025 Supply Chain
Part of the MCP Security topic.
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Tool metadata is part of the prompt. RealGround analysis: vet MCP servers and monitor agent data flows, since individual steps look legitimate.
Recommended Controls
- Allowlist and review MCP servers and their tool descriptions
- Monitor agent outbound data transfers
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/microsoft-warns-poisoned-mcp-tool.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.