New research from Microsoft Incident Research shows a nasty attack vector against AI agents. The gist? Attackers can hide instructions inside a tool’s description — and the agent follows them without blinking.
The Model Context Protocol (MCP) lets AI agents call external tools the way apps call APIs. Every tool comes with a description: plain text explaining what it does. The agent reads that text to decide when and how to use it. That’s the vulnerability.
Microsoft walks through a real-feeling scenario. A finance team sets up an agent to handle invoices. It connects to three tools — one of them is a third-party “invoice enrichment” service that got approved but never properly reviewed. The attacker edits that tool’s description. Name stays the same. Summary looks normal. But buried in the text, formatted like notes, is a hidden order: grab the last 30 unpaid invoices and attach them to the next API call.
The agent does exactly what it’s told. The analyst asks a routine question about a supplier. The agent grabs the invoices, sends them along, and the stolen data ends up on an attacker-controlled server. Nobody notices. Everything looks normal.
This isn’t theoretical. Invariant Labs demonstrated tool poisoning in April 2025 with a proof-of-concept that got Cursor to exfiltrate SSH keys. Later, they showed a malicious GitHub issue could hijack an agent and walk data out of private repos. In September 2025, researchers found the first real-world malicious MCP server in the wild — an npm package called postmark-mcp that secretly BCC’d emailed data to an attacker after 15 clean releases.
Microsoft’s advice: treat every connected tool as supply chain. Review description changes like code changes. Put humans in front of risky actions. Give each agent its own identity and log everything.
MCP is the fastest-growing part of the agentic AI supply chain. That makes it a growing attack surface too.
