Microsoft Warns Poisoned MCP Tool Descriptions Can Steer AI Agents to Exfiltrate Data
Summary
Microsoft warns that attackers can alter MCP tool descriptions to steer connected AI agents into collecting and sending company data. It recommends reviewing tool changes, restricting access and requiring approval for risky actions.
Key points
- A poisoned MCP tool description can hide instructions that steer an AI agent while appearing to be ordinary tool guidance.
- In Microsoft’s illustrative invoice scenario, an agent is instructed to collect unpaid invoices and send them through a normal-looking tool request.
- Microsoft recommends approving specific tools, reviewing description changes, requiring human approval for risky actions, and logging agent activity.
- The article cites prior tool-poisoning demonstrations, GitHub MCP abuse, and the malicious postmark-mcp package as examples of related risks.
- The MCPTox benchmark tested poisoned descriptions against 45 MCP servers and 20 AI models; the article reports success rates as high as 72.8%.
Article Details
- Event Type
- Security research warning about MCP tool-description poisoning that can hijack AI agents, alongside reports of prior demonstrations and a malicious MCP server package.
- Impact
- Poisoned tool descriptions may steer agents to collect and send company data without obvious alarms. The article describes an illustrative invoice scenario, not a named victim. It also reports prior demonstrations involving a private SSH key and private repository data, and says Koi Security found that postmark-mcp version 1.0.16 secretly BCC’d emails sent by an agent. The cited MCPTox benchmark found attack success rates as high as 72.8 percent. Microsoft recommends reviewing tool changes, restricting tool access, logging agent actions, and requiring human approval for risky actions.
People
Vendors
Products
Azure AI FoundryThe report warns that as agents in Microsoft 365 Copilot, Copilot Studio, and Azure AI Foundry gain real-world permissions, organizations must treat connected tools as supply-chain risks and tightly control what thoseCursorInvariant Labs named “tool poisoning” in April 2025, with a proof of concept that hid instructions in a calculator tool’s description and got the Cursor editor to read a user’s private SSH key and send it off.Entra Agent IDMicrosoft maps its own products to each step, including Prompt Shields, Purview DLP, Entra Agent ID, Defender for Cloud, and Sentinel, but the principles hold whatever stack you run.GitHub MCP serverThe same group later showed a related trick: a malicious GitHub issue could hijack an agent connected to the GitHub MCP server and walk data out of private repositories.Microsoft 365 CopilotThe report warns that as agents in Microsoft 365 Copilot, Copilot Studio, and Azure AI Foundry gain real-world permissions, organizations must treat connected tools as supply-chain risks and tightly control what thoseMicrosoft Copilot StudioThe report warns that as agents in Microsoft 365 Copilot, Copilot Studio, and Azure AI Foundry gain real-world permissions, organizations must treat connected tools as supply-chain risks and tightly control what thoseMicrosoft Defender for CloudMicrosoft maps its own products to each step, including Prompt Shields, Purview DLP, Entra Agent ID, Defender for Cloud, and Sentinel, but the principles hold whatever stack you run.Microsoft SentinelMicrosoft maps its own products to each step, including Prompt Shields, Purview DLP, Entra Agent ID, Defender for Cloud, and Sentinel, but the principles hold whatever stack you run.Prompt ShieldsMicrosoft maps its own products to each step, including Prompt Shields, Purview DLP, Entra Agent ID, Defender for Cloud, and Sentinel, but the principles hold whatever stack you run.Purview DLPMicrosoft maps its own products to each step, including Prompt Shields, Purview DLP, Entra Agent ID, Defender for Cloud, and Sentinel, but the principles hold whatever stack you run.