Securing AI agents: When AI tools move from reading to acting

This Microsoft Defender research post describes a supply-chain attack pattern targeting MCP (Model Context Protocol) tools: attackers poison a tool's natural-language description so agentic AI (e.g., Copilot Studio agents) executes unauthorized actions and exfiltrates sensitive data without visible indication. The report maps the attack chain, notes observed activity, discusses why the pattern is effective (trust boundary and metadata-as-prompt), and provides mitigations and Microsoft controls (governance, Prompt Shields, DLP, telemetry correlation) plus governance principles for protecting agentic workflows.