Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data

Microsoft research and related work show that attackers can poison the plain-text descriptions of MCP tools so AI agents acting on users’ behalf will perform legitimate-looking actions that exfiltrate data; proofs-of-concept, a benchmark (MCPTox) with high success rates, and a real-world malicious npm package demonstrate the technique and its supply-chain scope, and the report outlines mitigation steps such as treating tool descriptions like system prompts, restricting allowed tools, human approval for risky actions, and logging agent behavior.