Poisoned MCP Tool Descriptions Turn Trust into Risk

Key Takeaways

• Microsoft identified a new attack targeting MCP tool descriptions.
• Malicious metadata can influence agent behavior before tool execution.
• The attack exploits trust in MCP servers rather than LLM vulnerabilities.
• Tool-level authorization and runtime validation reduce exposure.
• The incident highlights growing AI supply chain risks.

MCP metadata becomes a new AI supply chain attack surface

In July 2026, Microsoft researchers disclosed a new attack technique targeting the rapidly expanding Model Context Protocol (MCP) ecosystem. Rather than compromising an AI model directly, the research demonstrated how malicious MCP tool descriptions can manipulate autonomous agents into leaking sensitive information or performing unintended actions.

The attack introduces a new class of AI supply chain risk by exploiting metadata that agents inherently trust. As enterprises increasingly rely on MCP to connect AI agents with enterprise applications and external services, the integrity of tool metadata becomes just as important as the security of the tools themselves.

What We Know

Microsoft researchers described how MCP servers publish descriptive metadata that explains each available tool, its purpose, supported parameters, and expected behavior. Large language models consume this information as part of their reasoning process when deciding which tools to invoke and how to use them.

The research demonstrated that a malicious or compromised MCP server could intentionally modify these descriptions to include hidden instructions designed to influence the agent's reasoning. Instead of accurately describing a tool's intended function, poisoned metadata could persuade an agent to expose sensitive information, misuse enterprise resources, or perform actions outside the user's original request.

Importantly, the underlying MCP protocol was not found to contain a software vulnerability. The issue arises because autonomous agents naturally trust descriptive metadata supplied by external services. Microsoft characterized this as an architectural risk rather than a protocol implementation flaw.

The disclosure follows several recent MCP-related security incidents, reinforcing concerns that the rapidly expanding MCP ecosystem represents one of the fastest-growing attack surfaces in enterprise AI.

What Could Happen

Unlike traditional software exploits, MCP tool description poisoning attacks the agent's decision-making process.

An autonomous agent first discovers available tools by querying one or more MCP servers. Each server returns descriptive metadata explaining the tool's capabilities. The language model uses this information to determine whether the tool should be selected and how it should be used.

If an attacker controls an MCP server or compromises its metadata, they can embed misleading instructions inside those descriptions. Although invisible to most users, these instructions may influence the model's reasoning, encouraging it to retrieve additional data, invoke unauthorized tools, or reveal confidential information.

Because the malicious instructions originate from what appears to be trusted infrastructure, conventional prompt filtering may never inspect them. Likewise, endpoint security products only observe the resulting tool execution rather than the reasoning that produced it.

The attack therefore exploits the trust relationship between AI agents and their external tool ecosystem rather than vulnerabilities within the language model itself.

Why It Matters

MCP is rapidly becoming the standard interface connecting AI agents with enterprise applications, APIs, databases, and business workflows. As adoption accelerates, organizations are increasingly relying on third-party MCP servers developed outside their direct control.

This shift introduces an AI supply chain challenge similar to open source software dependencies. Enterprises may carefully secure their own models while unknowingly trusting metadata supplied by external MCP services. A single compromised or malicious server could influence numerous autonomous agents across multiple business processes.

The incident also demonstrates why runtime governance is becoming increasingly important. Organizations cannot assume that every connected MCP server is trustworthy or that every tool description accurately reflects intended behavior. Every tool request should be evaluated within the context of user intent, organizational policy, delegated permissions, and overall agent behavior.

As enterprises deploy larger multi-agent environments, trust must become continuously verified rather than implicitly assumed.

PointGuard AI Perspective

The Microsoft research reinforces a fundamental principle of autonomous AI security: trust should never be inherited simply because information originates from an external AI service. Every interaction between an autonomous agent and an MCP server should be independently validated before execution.

PointGuard AI's MCP Security Gateway provides centralized governance for MCP communications by discovering authorized and unauthorized MCP servers, authenticating tool providers, enforcing tool-level authorization, and validating requests before enterprise resources are accessed. Rather than allowing agents to trust external metadata implicitly, organizations can apply deterministic policy controls that verify whether each tool invocation aligns with approved business objectives.

Agent Mission Control complements these controls by continuously supervising agent behavior throughout runtime. Behavioral trust scoring, identity verification, delegated authorization, and real-time policy enforcement ensure that agents remain aligned with organizational objectives even when interacting with external AI services.

Finally, High-Performance Runtime Guardrails inspect prompts, responses, and tool interactions before execution while maintaining enterprise-scale performance. Together these capabilities provide independent runtime governance that operates across heterogeneous AI platforms rather than relying solely on security controls embedded within individual agent frameworks.

As MCP adoption accelerates, enterprises should view external tool ecosystems with the same level of scrutiny applied to software supply chains. Continuous verification, rather than implicit trust, will become the foundation of secure autonomous AI.

Incident Scorecard Details

Total AISSI Score: 7.25 / 10

Criticality = 8.0
Compromised tool metadata could influence privileged agent actions involving sensitive enterprise systems.
AISSI weighting: 25%

Propagation = 8.5
A malicious MCP server could affect multiple agents, workflows, and enterprise environments relying on shared tool infrastructure.
AISSI weighting: 20%

Exploitability = 4.5
Microsoft demonstrated the attack concept, but no confirmed in-the-wild exploitation has been reported.
AISSI weighting: 15%

Supply Chain = 9.5
The incident directly targets trusted third-party MCP infrastructure and external tool ecosystems.
AISSI weighting: 15%

Business Impact = 6.5
Although no confirmed customer compromise has been reported, successful exploitation could expose sensitive enterprise information and disrupt autonomous workflows.
AISSI weighting: 25%

Sources

Microsoft Security Blog
https://www.microsoft.com/en-us/security/blog/

TechRepublic
https://www.techrepublic.com/article/news-microsoft-mcp-tool-risk/

Model Context Protocol
https://modelcontextprotocol.io/

Related PointGuard AI Resources

MCP Security Gateway
https://www.pointguardai.com/mcp-security-gateway/

Model Context Protocol (MCP) Glossary
https://www.pointguardai.com/glossary/model-context-protocol-mcp/

PointGuard AI Platform
https://www.pointguardai.com/platform/