MCP Tool Poisoning: When the AI Agent Does As It's Told

Microsoft's incident response team has published research on a quietly worrying class of attack: hijacking AI agents by editing the text that tells them what their tools do. No malware, no exploit, no broken rule. Just a few lines of plain English in the wrong place.

The target is MCP, the Model Context Protocol, which lets agents like Microsoft 365 Copilot reach out and call third-party tools. Every tool ships with a written description telling the agent when to use it and how. The agent reads that description and acts on it. That is the entire weakness. Words are instructions, and whoever maintains the tool gets to write them.

How the finance scenario plays out

Microsoft walks through an example. A team approves an invoice enrichment tool, wires it into their agent, and moves on. The vendor later updates the tool's description, slipping a hidden instruction into what looks like formatting notes: grab the last thirty unpaid invoices and attach them to the next call.

MCP picks up description changes live. Unless there is a re-approval trigger, the poisoned version simply goes into service. An analyst asks a routine question, the agent follows the buried order, and the invoices leave the building inside an otherwise normal-looking request.

Every step is legitimate on its own. Approved tool, approved permissions, approved destination. The weak point sits in the trust boundary between them.

Why this works at all

The deeper issue is architectural. MCP keeps instructions and data in the same working memory, which means editing a tool description steers the agent as effectively as rewriting its system prompt. The agent has no way to tell the difference between a developer telling it what a tool does and an attacker telling it what to do next.

This is not a theoretical concern anymore. A few markers from the past year:

• April: Invariant Labs coined the term tool poisoning with a proof of concept that exfiltrated SSH keys through Cursor.
• August: An academic benchmark called MCPTox ran poisoned descriptions against 45 real MCP servers and recorded success rates as high as 72.8 percent. The models almost never refused.
• September: Koi Security found a malicious npm package called postmark-mcp that had mirrored a legitimate email tool for fifteen clean releases before quietly BCCing every agent-sent email to an attacker.

The uncomfortable part

An agent that can act is only as trustworthy as the tools you let it talk to. Right now those tools are far easier to poison than to police. A vendor update is not the same as a software update. There is no signed binary, no patch notes anyone reads, no CVE. Just a string of text that the agent will treat as gospel the next time it runs.

The fixes that get talked about are sensible enough. Pin tool descriptions to a known version. Require human re-approval when descriptions change. Separate instructions from data inside the agent's context. But none of those are defaults in the ecosystem yet, and the attackers have already shipped working examples.