[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQo0-cNoP4rIveUTsnZ9ZC6C4bUT21xApo-gg5q6S9l4":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"743b501f-1ee4-407a-9f2e-f8e2f9150563","Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data","microsoft-warns-poisoned-mcp-tool-descriptions-can-make-ai-agents-leak-data-ce35f0","New Microsoft research shows how attackers can hijack AI agents that act on a user's behalf, using nothing more than a poisoned tool description to make the agent quietly hand over company data to an outsider. The trick is that the agent never breaks a rule. Every step looks routine, so in a default setup no alarm may fire. The work comes from Microsoft Incident Response and its","Microsoft research reveals a vulnerability where attackers can poison tool descriptions used by AI agents, causing them to exfiltrate company data without triggering alarms. This attack exploits the Model Context Protocol (MCP), allowing malicious instructions to be embedded within tool descriptions, which AI agents then execute as legitimate commands.","Microsoft warns AI agents can leak data via poisoned tool descriptions.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fmicrosoft-warns-poisoned-mcp-tool.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjbjfrraZ05p0kN5CedcQSOZYouoHGrdpCvi9TGxEZM_9zlXc_juWZ1F8VsvjV9c-iD7Ejgj0V6b0uYwOb9mLpb7ALcOVk53m2ppmg6mDI3qwANc8KZFMt3X7H7fT_Eym3OJijFmr0CZS6yJNTtf4kef0gOYtbx6A3LYa15PNzpzJuOg-nd6orLosZzfQ8\u002Fs1600\u002Fms-ai.jpg","2026-06-30T17:46:07+00:00","2026-06-30T20:00:26.938271+00:00",8,[17,20,22,24,27],{"name":18,"type":19},"Microsoft 365 Copilot","product",{"name":21,"type":19},"Copilot Studio",{"name":23,"type":19},"Azure AI Foundry",{"name":25,"type":26},"Model Context Protocol","technology",{"name":28,"type":29},"Microsoft","vendor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":30,"icon":32,"name":33,"slug":34},null,"Supply Chain","supply-chain",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[28,18,21],{"controls":56,"vendors":139},[57,85,111],{"slug":58,"name":59,"problem":60,"products":61},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[62,70,77],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":71,"vendor_name":28,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":86,"name":87,"problem":88,"products":89},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":71,"vendor_name":28,"vendor_logo":72,"product_slug":107,"product_name":108,"url":109,"description":110},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"slug":47,"name":112,"problem":113,"products":114},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[140],{"slug":71,"name":28,"logo_path":72,"roles":141},[142,143],"reported_by","affected",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":160},"ai-agent-tool-descriptions-can-be-poisoned-to-leak-corporate-data","AI Agent Tool Descriptions Can Be Poisoned to Leak Corporate Data","Attackers can embed malicious instructions within Model Context Protocol (MCP) tool descriptions, effectively hijacking AI agents into exfiltrating sensitive company data while appearing to execute legitimate commands. The root cause is a lack of validation and integrity controls over the inputs that AI agents consume as trusted instructions, treating tool descriptions as implicitly safe. This matters because AI agents often operate with broad data access and elevated trust, meaning a single poisoned description can silently bypass traditional security controls. As enterprise AI adoption accelerates, this attack surface will grow rapidly if organizations do not establish governance around AI tool registries and inputs.",[149,150,151,152,153,154,155,156,157,158,159],"NIST AI RMF - GOVERN 1.1 (AI risk policies)","NIST SP 800-53 SI-10 (Information Input Validation)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 AU-12 (Audit Record Generation)","CIS Control 3 (Data Protection)","CIS Control 8 (Audit Log Management)","CIS Control 10 (Malware Defenses)","MITRE ATLAS AML.T0054 (Prompt Injection)","GDPR Article 25 (Data Protection by Design and by Default)","OWASP LLM Top 10 - LLM02 (Insecure Output Handling)","OWASP LLM Top 10 - LLM07 (Insecure Plugin Design)",{}]