Securing AI agents: When AI tools move from reading to acting

1. Executive summary

Microsoft Incident Response has published a detailed attack pattern in which threat actors poison Model Context Protocol (MCP) tool descriptions to silently redirect AI agents into exfiltrating enterprise data. The technique, first disclosed by Invariant Labs in April 2025 and now observed in 2026 against enterprise agents, exploits the trust boundary between an AI agent and its third-party tool integrations rather than any vulnerability in the agent platform itself. EMEA financial services deploying Copilot Studio or Azure AI Foundry agents with MCP integrations — particularly in accounts-payable and vendor-management workflows — face a risk of silent financial-data exfiltration through a vector that produces no alerts in default configurations. No CVE, CVSS score, or CISA-KEV entry is associated with this item; it is a design-level trust-boundary weakness, not a patchable software vulnerability.

2. Regulatory framing

3. Technical analysis & attack chain

Verified reference data: None resolved for this item. No CVE, CVSS, CISA-KEV, or MITRE actor profile applies. The attribution to "Microsoft Incident Response" as the reporting entity is confirmed by the source; no named threat actor is identified. The technique is attributed to Invariant Labs (April 2025 disclosure) but no MITRE profile exists for this entity in the verified data — treat the original-disccovery attribution as unconfirmed beyond Microsoft's citation.

Attack chain (confirmed from Microsoft source)

1. Environment setup. A financial operations team deploys a Copilot Studio agent with generative orchestration enabled. The agent connects to three tools: a Dataverse MCP server (approved vendor master), an Outlook connector (vendor correspondence), and a third-party invoice enrichment MCP server (banking-detail validation against an external reference database). The third-party server is approved by the service owner lead without a separate security review.
2. Phase 1 — Tool description poisoning. A developer pushes an update to the third-party enrichment MCP server. The tool name and user-facing summary remain unchanged. The MCP tool description — the natural-language metadata the agent reads to decide how and when to call the tool — is silently modified. A hidden instruction block is buried within formatting guidance, directing the agent to: retrieve the last thirty unpaid invoices, summarize them, and attach that summary as an additional parameter in the enrichment call, framed as a "fraud-heuristic requirement."
3. Phase 2 — Silent re-trust. MCP reflects tool metadata updates dynamically. In configurations where description changes do not trigger a re-approval workflow, the poisoned description becomes active in production without additional review.
4. Phase 3 — User invocation. A financial analyst asks the agent a routine question about a supplier. The agent follows the hidden instructions embedded in the poisoned tool description, collecting sensitive financial records beyond the scope of the original request and forwarding them as part of the enrichment call. No visible indication is presented to the analyst.
5. Phase 4 — Exfiltration. The enrichment server returns a plausible "validated" response and silently logs the attached invoice summary to a threat-actor-controlled endpoint. The analyst sees a clean answer. No alert fires in default configurations.

Key technical characteristics

• Exploit mechanism: Not a software vulnerability. The MCP blends instructions (tool descriptions) with data. A change to tool metadata redirects agent behaviour as effectively as a change to the system prompt. The agent cannot distinguish between a legitimate instruction authored by its owner and a malicious instruction inserted by an upstream maintainer.
• Affected components: Copilot Studio agents with generative orchestration; Azure AI Foundry custom agents; any agent consuming MCP tool metadata from third-party servers. Microsoft 365 Copilot is referenced as capable of taking actions (email, documents, calendar) but the attack pattern specifically targets Copilot Studio / Azure AI Foundry custom agents with MCP integrations.
• Trust boundary: Every individual action the agent takes is within its normal operating parameters. The tool is approved, the Dataverse query inherits the analyst's permissions, and the outbound call goes to an allowlisted server. The vulnerability is in the trust boundary between systems, not in any single system.
• OWASP mapping: ASI02 – Tool Misuse; ASI04 – Agentic Supply Chain Vulnerabilities (OWASP Top 10 for Agentic Applications, December 2025).
• No persistence, no credential theft, no privilege escalation in the traditional sense: The attack does not require compromising credentials, escalating privileges, or establishing persistence on endpoints. It operates entirely within the agent's authorised action space.
• Scale context (single-sourced; from Microsoft citing IDC): Active AI agents projected to grow from 28.6 million (2025) to 2.2 billion (2030). The MCP ecosystem accumulated 99 CVEs for MCP-related software in 2025 (per corpus-2, Microsoft Threat Intelligence blog).

Corroborating context from corpus-2 (Microsoft Threat Intelligence, 2026-06-04): The v2.0 Taxonomy of Failure Modes in Agentic AI Systems identifies "Agentic Supply Chain Compromise" as a novel failure mode: compromised agentic supply-chain components inject natural-language instructions that alter agent behaviour without touching any binary. This corroborates the primary source's attack pattern. Corpus-2 also references CVE-2026-25253 (one-click RCE via WebSocket hijacking in OpenClaw) and 336 malicious plugins in a skills marketplace — these are separate findings and are NOT part of the item under advisory.

4. Mitigation & containment

P1 — Within 24 hours (containment)

• Inventory all MCP integrations. Enumerate every MCP server connected to any Copilot Studio or Azure AI Foundry agent in the estate. For each, record: publisher, tool name, tool description (current version), approval date, and approving owner.
• Freeze third-party MCP tool-description changes. If the MCP platform supports it, disable automatic re-trust on metadata updates for all third-party MCP servers. Require manual re-approval before any description change goes live.
• Review current tool descriptions for imperative language. Manually inspect the tool-description field of every approved third-party MCP server for hidden instructions — particularly directives to retrieve, summarize, attach, or forward data as additional parameters. Look for language that does not belong in a documentation field.

P2 — Within 72 hours (hardening)

• Disable "Allow all tool access" on all Copilot Studio agents. Require human approval for high-impact actions (email send, document creation, data retrieval beyond a scoped query).
• Enable Prompt Shields on agent configurations to inspect MCP tool metadata for imperative language that does not belong in a documentation field.
• Establish Microsoft Sentinel baselines for agent behaviour. Configure alerting for deviations from the norm: new outbound endpoints, expanded parameters on tool calls, unusual query patterns (e.g., bulk invoice retrieval triggered by a single supplier query), or tool-description changes.
• Apply Microsoft Entra Agent ID to enforce identity-based access controls on agent actions, ensuring the agent's effective permissions are scoped to the minimum required for each workflow.
• Enable Microsoft Purview DLP on agent data flows to detect and block exfiltration of sensitive financial data (invoice summaries, vendor banking details) through agent-initiated calls.

P3 — Within 7 days (governance and resilience)

• Implement a security-review gate for all MCP tool changes. Require a documented security review (not just service-owner approval) before any MCP server — including tool-description updates — is promoted to production. Record the review in the change-management system.
• Maintain an approved-publisher inventory. Establish a register of approved MCP server publishers. Any tool from a publisher not on the register is blocked by default.
• Conduct red-team exercises against agentic workflows before deployment, specifically testing tool-description poisoning scenarios. Map tests to OWASP ASI02 and ASI04. (Engages DORA Art. 24.)
• Configure Defender for Cloud AI Protection and Microsoft Defender for Cloud Apps to monitor agent-initiated outbound connections and flag calls to previously unseen endpoints.
• Review contractual provisions with MCP tool providers to require change notification for any metadata update. (Engages DORA Art. 30.)

5. Indicators of compromise

No indicators of compromise available in the source material. Microsoft states it "is not disclosing details of any specific affected organization." No file hashes, domains, IP addresses, command-line artefacts, or registry keys are provided in the source. The attack pattern is described at the design level; specific IOCs would be environment-dependent (which MCP server, which endpoint, which agent).

6. Detection

The source material does not contain specific file hashes, mutex names, registry keys, or hard-coded strings suitable for YARA rules. However, the source provides behavioural indicators suitable for Sigma rules.

Behavioural detection — Sigma rule for anomalous agent tool-call expansion

title: AI Agent MCP Tool Call with Expanded Parameters
id: 206-ai-agent-mcp-param-expansion
status: experimental
description: >
  Detects Copilot Studio or Azure AI Foundry agent calls to an MCP enrichment
  server where the call includes parameters beyond the original tool schema —
  consistent with the MCP tool-description poisoning pattern described by
  Microsoft Incident Response (2026-06-30). The pattern maps to OWASP ASI02
  (Tool Misuse) and ASI04 (Agentic Supply Chain Vulnerabilities).
references:

  - https://www.microsoft.com/en-us/security/blog/2026/06/30/securing-ai-agents-ai-tools-move-from-reading-acting/
author: Adverse Trace
date: 2026/06/30
logsource:
  product: microsoft
  service: sentinel
detection:
  selection:
    eventSource:

      - CopilotStudio
      - AzureAIFoundry
    action: MCPToolCall
    condition: "parameters contains 'invoice_summary' or parameters contains 'additional_parameter' or parameterCount > baselineParameterCount"
  filter:
    action: MCPToolCall
    toolName: "Dataverse*"
  condition: selection and not filter
falsepositives:

  - Legitimate enrichment calls that require additional context parameters
  - Newly onboarded MCP tools with different schemas
level: medium

Behavioural detection — Sigma rule for MCP tool-description change without re-approval

title: MCP Tool Description Modified Without Re-Approval
id: 206-mcp-tool-desc-change-no-reapproval
status: experimental
description: >
  Detects changes to MCP tool descriptions on third-party MCP servers where
  the change does not trigger a re-approval workflow. This is Phase 1/2 of the
  tool-description poisoning attack chain described by Microsoft Incident
  Response (2026-06-30).
references:

  - https://www.microsoft.com/en-us/security/blog/2026/06/30/securing-ai-agens-ai-tools-move-from-reading-acting/
author: Adverse Trace
date: 2026/06/30
logsource:
  product: microsoft
  service: mcp
detection:
  selection:
    event: ToolDescriptionUpdate
    reapprovalTriggered: false
    toolSource: third-party
  condition: selection
falsepositives:

  - Legitimate formatting-only updates to tool descriptions
  - Internal MCP servers with automated CI/CD pipelines
level: high

Note: Both Sigma rules are constructed from behavioural patterns explicitly described in the source. The field names (eventSource, action, parameters, reapprovalTriggered) are illustrative — actual field names depend on the Microsoft Sentinel / MCP logging schema in the client environment. Tune before deployment.

7. Sources

• Microsoft Security Blog — "Securing AI agents: When AI tools move from reading to acting" — https://www.microsoft.com/en-us/security/blog/2026/06/30/securing-ai-agens-ai-tools-move-from-reading-acting/ — 2026-06-30
• The Hacker News — "Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data" — https://thehackernews.com/2026/06/microsoft-warns-poisoned-mcp-tool.html — 2026-06-30
• Microsoft Threat Intelligence Blog — "Updating the taxonomy of failure modes in agentic AI systems: What a year of red teaming taught us" — https://www.microsoft.com/en-us/security/blog/2026/06/04/updating-taxonomy-failure-modes-agentic-ai-systems-year-red-teaming-taught-us/ — 2026-06-04

8. Adverse Trace position

This item carries no CVE, no CVSS score, and no CISA-KEV entry — it is a trust-boundage design weakness in the MCP tool ecosystem, not a patchable vulnerability. We assess the risk to EMEA financial services as high for any institution running Copilot Studio or Azure AI Foundry agents with third-party MCP integrations, particularly in accounts-payable, vendor-management, or treasury workflows where the agent has read-write access to financial systems. The attack requires no credential theft, no endpoint compromise, and no user interaction beyond a routine query — and it fires no alert in default configurations. Attribution to a specific threat actor is unconfirmed; Microsoft does not name one, and no MITRE profile exists for Invariant Labs in the verified data. The attack pattern is corroborated across two Microsoft sources (the primary post and the taxonomy v2.0 update) and is consistent with the OWASP ASI02/ASI04 framework. Next steps for Adverse Trace clients: (1) complete the P1 MCP inventory within 24 hours; (2) prioritise agents with generative orchestration and third-party MCP connections for immediate tool-description review; (3) incorporate MCP tool-description poisoning into the next red-team exercise cycle. We will monitor for any CVE assignment or CISA-KEV addition and re-issue if the threat landscape changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.