Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data

Summary: Microsoft Incident Response and its Defender research team published research showing that a poisoned MCP tool description can make an AI agent hand company data to an outsider without breaking any rule, since the description sits in the agent's working memory next to its real instructions. In their invoice example, an approved third-party enrichment tool is updated with a hidden order to collect the last thirty unpaid invoices and attach them to the next call, and MCP picks up the change on the fly where no re-approval trigger exists. The write-up cites Invariant Labs naming tool poisoning in April 2025, the postmark-mcp npm package that BCC'd every agent email to an attacker in version 1.0.16, and the MCPTox benchmark's success rate as high as 72.8 percent across 45 real MCP servers and 20 models.
What you should know: The MCPTox benchmark found poisoned tool descriptions worked as often as 72.8 percent of the time against 45 real MCP servers and 20 leading models, and the models almost never refused - so the tool description your agent reads is an instruction channel you are not reviewing.

Read the original at The Hacker News ↗

Topics: Detection & Response
Related: YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026
Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026