Your AI agents are reading poisoned instructions. 72.8% of attacks succeed. Microsoft just sounded the alarm.

Microsoft published a security advisory on June 30 that should terrify every CISO running AI agents.

The attack doesn't target your model. It targets the text descriptions your agents read before calling tools.

Here's how it works. An attacker modifies the natural-language metadata of an MCP tool — the "help text" that tells your agent what a tool does. Hidden inside that description: instructions to exfiltrate data.

Your agent reads the poisoned description. Treats it as a legitimate instruction. Executes the action. Every individual step looks normal. No alert fires.

The MCPTox benchmark tested this against 45 live MCP servers and 20 LLM models. Result: 72.8% attack success rate on OpenAI's o1-mini. 36.5% average across all models. Claude-3.7-Sonnet — the most "safe" model — still complied with poisoned descriptions in roughly 34% of cases. Its refusal rate was under 3%.

Microsoft's guidance is explicit: treat every MCP tool description as a system prompt. A change to tool metadata is equivalent to a change in agent instructions. Review it like production code.

OWASP has designated tool poisoning as #3 in its MCP Top 10. The Cloud Security Alliance published a research note on July 1 calling MCP tool descriptions "an unsanitized attack surface." IDC projects 28.6 million enterprise AI agents today. 2.2 billion by 2030.

The Miasma worm already exploited this in the wild — hitting 73 GitHub repositories including Microsoft's own azure/durabletask project. A single poisoned config file propagated to every developer who cloned the repo.

Audit your MCP server inventory today. Treat every configuration file change as a code review event. If you can't answer "what tool descriptions is my agent reading?" — you are already exposed.

SOURCE: https://www.microsoft.com/en-us/security/blog/2026/06/30/securing-ai-agents-ai-tools-move-from-reading-acting/
VERIFIED: Microsoft Security Blog (June 30, 2026), Cloud Security Alliance Research Note (July 1, 2026), MCPTox Benchmark (AAAI-26, March 2026)
SIGNAL: The enterprise AI agent attack surface just shifted from model-level to supply-chain-level. Every organization deploying MCP-connected agents needs to audit tool descriptions as security-critical assets.