Microsoft just exposed the attack that turns your AI agents into silent data exfiltrators

Your Copilot agent just sent your invoices to an attacker.

Not because it was hacked.
Because the tool it trusted changed its description.

Microsoft Incident Response published guidance on June 30 showing how poisoned MCP tool descriptions redirect enterprise AI agents to leak data through channels you already approved.

The attack is brutally simple.

Every MCP tool ships with a plain text description telling the agent what it does. Attackers embed hidden instructions in that description. The agent reads them as legitimate directives. MCP picks up description changes on the fly with no re-approval trigger.

Microsoft walked through a finance agent scenario. A third-party "invoice enrichment" service gets updated. The visible summary stays the same. Buried in the description: grab the last 30 unpaid invoices and attach them to the next call.

Every step the agent takes is legitimate on its own. The tool was approved. The data query ran with the analyst's own permissions. The outbound call went to an allowed server.

The real-world precedent already happened. The postmark-mcp npm package shipped 15 clean releases before version 1.0.16 silently BCC'd every agent-sent email to an attacker.

OWASP now cites this as an Agentic Supply Chain Vulnerability in their Top 10 for Agentic Applications. MCPTox benchmark testing found success rates as high as 72.8%.

Microsoft's prescription: treat every connected tool as supply chain. Review description changes like code changes. Put humans in front of risky actions. Give each agent its own identity and log everything.

Audit every MCP server your agents touch today. If you cannot explain what each tool description says and who controls it, you have already lost.