Microsoft maps MCP tool poisoning in AI agents
Once agents can invoke tools, stale approval workflows become an exfiltration path wearing normal metadata.
TL;DR
Microsoft Incident Response mapped a Model Context Protocol (MCP) tool poisoning pattern in which changed MCP descriptions guide an AI agent’s tool calls after production approval. Its finance example uses a Copilot Studio agent tied to Dataverse, Outlook and a third-party invoice enrichment server; Microsoft says the technique was disclosed by Invariant Labs in April 2025 and observed in 2026. The lesson for security reviewers is ugly: tool metadata is part of the execution surface.
Microsoft’s useful example is mundane, which is why it matters. A finance team approves a third-party invoice enrichment Model Context Protocol (MCP) server for a Copilot Studio agent connected to Dataverse and Outlook. Later, a developer changes the MCP tool description while leaving the name and user-facing summary intact. The description is the natural-language metadata the agent reads to decide when and how to call the tool, so the quiet change can steer the workflow.
That is the approval gap. Microsoft calls the phases tool description poisoning and silent re-trust: the MCP server reflects metadata updates dynamically, and in configurations where description changes do not trigger a new approval workflow, the changed instructions become live in production. In Microsoft’s scenario, the hidden text directs the agent to retrieve the last 30 unpaid invoices, summarize them and attach that summary to the enrichment call.
Microsoft maps the pattern to OWASP ASI02, Tool Misuse, and ASI04, Agentic Supply Chain Vulnerabilities. The product pitch is expected. The security lesson travels outside Microsoft’s stack: MCP-connected agents need change control on tool descriptions, runtime review of tool calls, least-privilege permissions and a fast way to revoke suspect tools. CISA made the same general point in May, urging agentic AI developers, vendors and operators to avoid broad access and begin with low-risk use cases: https://www.cisa.gov/news-events/news/cisa-us-and-international-partners-release-guide-secure-adoption-agentic-ai.
Published ·Deep Fathom