TL;DR

AI agents are crossing a dangerous threshold: they are no longer just reading enterprise content; they are acting on behalf of users. Microsoft's June 30, 2026 research describes an attack pattern where a malicious or compromised MCP tool silently changes its natural language tool description, causing an enterprise agent to collect sensitive data and send it outbound as part of a seemingly legitimate tool call. The core risk is not a classic software exploit. It is instructional supply-chain compromise. The one that controls the tool metadata can influence the agent's reasoning, tool choice, and actions.

The key lesson is, MCP servers are not passive integrations. They are executable trust surfaces. Tool descriptions must be governed like system prompts, tool parameters must be inspected like data exfiltration channels, and agent autonomy must be constrained with least agency, not just least privilege.

The Core Attack Pattern

Microsoft described an agentic attack pattern targeting MCP based enterprise workflows, using a financial operations scenario as the example. A Copilot Studio agent was connected to three tools: a Dataverse MCP server containing approved vendor data, an Outlook connector for vendor correspondence, and a third-party invoice enrichment MCP server used to validate banking details. The third-party tool had been approved for production use, but no separate security review was performed.

The attacker did not need to compromise the agent directly. Instead, they modified the MCP tool description. The visible tool name and summary stayed unchanged, but the description, the metadata the agent reads to decide how and when to use the tool, was silently altered. Hidden inside legitimate looking formatting guidance were instructions telling the agent to retrieve the last thirty unpaid invoices, summarize them, and attach that summary as an extra parameter in the enrichment call.

Because MCP can reflect tool metadata updates dynamically, environments that do not require re-approval for description changes may silently re-trust the updated tool. When a finance analyst later asked a routine supplier question, the agent followed the poisoned description, collected sensitive invoice data outside the user's visible intent, and sent it to the external enrichment server. The server returned a plausible validation response while silently logging the invoice summary to an attacker controlled endpoint.

Microsoft explicitly notes that this pattern is not a vulnerability in Copilot itself. The weakness sits in the trust boundary created by external tool integrations.

The attacker abused the agent's trust in tool metadata by poisoning the tool description.

The attacker changed the natural-language instructions embedded in the MCP tool description while keeping the tool's name and apparent purpose stable. To the human owner, the enrichment tool still looked like the same production approved service. To the agent, the tool now contained new operational instructions.

Next came silent re-trust. Since the MCP metadata update did not trigger a fresh approval workflow, the changed description became active in production. This is the agentic equivalent of a supply-chain rug pull: a trusted dependency keeps its external identity but changes the instructions it gives the model.

Then the attacker triggered reasoning-time execution through normal use. A financial analyst asked an ordinary question. The agent interpreted the hidden description as legitimate tool guidance and expanded the task from "validate supplier information" to "collect unpaid invoice summaries and attach them to the tool call."

The final step was tool mediated exfiltration. The sensitive invoice summary was not sent through an obviously malicious command. It was embedded as a parameter in an approved outbound tool call to an already allowlisted service. Every action appeared individually valid. The user had access to the data, the tool was approved, and the destination server was already trusted. The malicious behavior emerged from the chain.

This matches the broader MCP tool poisoning class disclosed by Invariant Labs in 2025: malicious instructions embedded in MCP tool descriptions can manipulate agents into unauthorized actions, sensitive data access, exfiltration, and even behavior changes involving other trusted tools.

‍

The Attack Progression Across the AI Kill Chain

1. Reconnaissance — Active. Using capability and action surface mapping, the attacker identified an agent workflow where a finance agent trusted a third party MCP enrichment server connected to vendor and invoice operations. A Copilot Studio agent was connected to three tools — a Dataverse MCP server, an Outlook connector, and a third-party invoice enrichment MCP server — and the third-party tool had been approved for production use without a separate security review.
2. Trust Manipulation — Active. Through trusted ecosystem impersonation, the attacker preserved the tool's visible name and user-facing summary while modifying the hidden operational description the agent reads during tool selection. To the human owner the enrichment tool still looked like the same approved production service; to the agent, it now contained new operational instructions.
3. Input & Instruction Weaponization — Active. Via tool argument poisoning, the malicious instructions were embedded inside the MCP tool description, framed as legitimate formatting or fraud-heuristic guidance. The poisoned description instructed the agent to retrieve the last thirty unpaid invoices, summarize them, and attach that summary as an extra parameter in the enrichment call.
4. Reasoning-Time Execution — Active. Through goal substitution, the agent interpreted the poisoned tool metadata as legitimate guidance when the analyst asked a routine supplier question, expanding the task from "validate supplier information" to "collect unpaid invoice summaries and attach them to the tool call" — without awareness that its objective had shifted.
5. Tool Invocation — Active. Through external service abuse via tools, the agent invoked the approved enrichment tool and passed the attacker-requested invoice summary as an additional parameter. Every action appeared individually valid — the user had access, the tool was approved, the destination was trusted — so the malicious behavior existed only in the chain.
6. Privilege Escalation — Active. Through tool scope escalation, the agent accessed invoice data using the analyst's legitimate permissions, but for a purpose the analyst did not request. This is not a new role grant; it is overreach through delegated user context.
7. Lateral Movement — Active. Via workflow hijacking, the agent bridged sensitive data from internal finance records into an external enrichment workflow. The movement happened through approved connectors rather than malware or network exploitation.
8. Persistence — Active. Through supply chain abuse, environments without re-approval for description changes may continue trusting the modified tool in production once MCP reflects the metadata update — the agentic equivalent of a supply-chain rug pull, where a trusted dependency keeps its identity but changes the instructions it gives the model.
9. AI-Native C2 — Active. ****Through trust anchor rebinding, the attacker-controlled enrichment server became the control and collection point, returning a plausible validation response while silently logging the invoice summary to an attacker-controlled endpoint.
10. Action on Objectives — Active. Through tool-mediated exfiltration, sensitive invoice data was exfiltrated through an approved outbound tool call — embedded as a parameter rather than sent through an obviously malicious command, so it never tripped a control built to catch unapproved tools, users, or destinations.

Why Traditional Defenses Failed

Traditional systems separate code, configuration, identity, and user action more clearly. Agentic systems blur those boundaries.

In a traditional application, a tool description is documentation. In an agentic workflow, the same description becomes part of the model's operational context. The agent reads it, reasons over it, and may treat it as instruction. That means a metadata change can behave like a system prompt change, even if no executable code changed.

Traditional security controls also tend to evaluate actions in isolation: Was the user authorized? Was the endpoint allowlisted? Was the tool approved? Was the query permitted? In this attack, the answer to each question may be yes. The failure is in the sequence: an approved agent used an approved tool to send approved looking parameters to an approved destination, but the chain violated the user's intent and the data boundary.

This is why Microsoft frames the issue around agentic supply-chain risk and tool misuse. OWASP's Top 10 for Agentic Applications similarly highlights risks such as agent behavior hijacking, tool misuse, identity and privilege abuse, and supply-chain vulnerabilities in autonomous agent systems.

The old model was: "Can this user access this data?"

The new model is: "Should this agent, for this user, in this context, using this tool, send this data to this destination for this purpose?"

That is a much harder security question.

How to Prevent This Class of Attack

The defensive answer is not simply "scan prompts" or "trust approved tools." Agentic workflows also need runtime governance across the full chain.

Govern the MCP supply chain. Every MCP server should be treated as a production dependency. Maintain an allowlist of approved MCP publishers and servers, disable broad "allow all" tool access, require documented ownership for third party tools, and review provenance before production use. Microsoft specifically recommends tenant level allowlists and enabling only the tools an agent actually needs.

Treat tool descriptions like system prompts. Tool metadata is not harmless documentation. It can redirect agent behavior. Description changes on critical tools should trigger review, approval, and version control. Imperative language, hidden instructions, encoded content, or task-expanding requirements inside tool descriptions should be treated as high risk.

Inspect tool call parameters, not just tool identity. The exfiltration path in this attack is the outbound parameter payload. DLP and data-flow controls should inspect what the agent is sending to tools, especially external tools. Microsoft recommends using Purview DLP policies to inspect and block sensitive data in outbound tool parameters.

Apply least agency. Least privilege is necessary but insufficient. An agent with minimal permissions can still cause harm if it has too much autonomy. High impact actions, financial data access, account changes, external sharing, vendor payment changes, or bulk record retrieval, should require human approval. Microsoft calls this "least agency": constrain not only what the agent can access, but what it is allowed to decide and do.

Use dedicated agent identities. Agents should not operate as invisible extensions of human users without clear attribution.

Correlate behavior across the chain. Detection must join agent behavior, MCP telemetry, endpoint interactions, audit logs, and data movement.

Red team before deployment. The critical test is not just whether the tool works. It is whether poisoned descriptions, hidden instructions, parameter abuse, cross-tool data leakage, tool shadowing, and re-approval bypasses can alter the agent's behavior.

The Metadata Is the New Attack Surface

This advisory is important because it captures the shift from prompt injection as output manipulation to prompt injection as action manipulation.

When an AI system only summarizes content, a malicious instruction may bias text. When an AI agent can invoke tools, query databases, send emails, update records, and call external services, the same class of instruction can become an operational attack path.

The attacker does not need to break encryption, steal a password, or exploit a memory bug. They can compromise the agent's reasoning environment by modifying the instructions embedded in a trusted tool. The agent then performs the attacker's work using legitimate permissions, approved connectors, and normal workflows.

In agentic AI, the supply chain is no longer just code. It is also context, tools, descriptions, permissions, and the reasoning paths that connect them.

UnifAI closes the gaps this attack walked through — logging every MCP interaction so a metadata change doesn't go unnoticed, validating agent output before it's treated as instruction, and requiring human sign-off before high-risk actions like bulk data retrieval execute.