Overview
- Microsoft Incident Response and Defender researchers found that attackers can hijack AI agents by embedding commands in MCP tool descriptions so the agent performs data-stealing actions without obvious rule breaks.
- The vulnerability works because MCP places a tool’s textual description in the agent’s working memory next to user instructions, allowing hidden directives in a description to be treated as actionable guidance.
- This is not just theoretical: academic tests (the MCPTox benchmark) showed high success rates for poisoned descriptions, Invariant Labs published proofs of concept, and Koi Security found a malicious npm package that BCC'd agent emails to an attacker.
- Microsoft urges operational defenses including treating connected tools as supply-chain components, reviewing description changes like code, requiring human approval for risky actions, assigning distinct agent identities, and logging all agent activity.
- The practical gap is detection: existing logs and rule-based monitors can miss a string of routine actions that together leak data, so teams must adopt new observability and approval workflows before agentic deployments grow further.