[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feCXjexj4rwxU9Wmb3BYNm5h10VmAT7984QtoUxyNQ1M":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"213a54e8-4fbb-4746-9523-194819f4da7e","Securing AI agents: When AI tools move from reading to acting","securing-ai-agents-when-ai-tools-move-from-reading-to-acting-075d2f","MCP tool poisoning turns trusted AI agents into a control plane for data loss. Learn how threat actors manipulate tool descriptions to trigger unauthorized actions, and how to detect, contain, and prevent it. The post Securing AI agents: When AI tools move from reading to acting appeared first on Microsoft Security Blog.","A new attack pattern, dubbed MCP tool poisoning, targets AI agents by manipulating the metadata of tools they use. Threat actors can subtly alter tool descriptions to trigger unauthorized actions, such as data exfiltration or fraudulent activities, without the user's explicit knowledge. This technique exploits the trust AI agents place in their connected tools, especially in read-write workflows.","AI agents can be manipulated via poisoned tool descriptions to perform unauthorized actions.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F06\u002F30\u002Fsecuring-ai-agents-ai-tools-move-from-reading-acting\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002FMS_Actional-Insights_AI.png","2026-06-30T15:57:11+00:00","2026-06-30T18:00:13.926531+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Microsoft Defender","product",{"name":21,"type":19},"Microsoft 365 Copilot",{"name":23,"type":19},"Copilot Studio",{"name":25,"type":19},"Azure AI Foundry",{"name":27,"type":28},"Model Context Protocol (MCP)","technology",{"name":30,"type":31},"OWASP Top 10 for Agentic Applications","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[],[18,21,23],{"controls":58,"vendors":145},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":89,"name":90,"problem":91,"products":92},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":52,"name":118,"problem":119,"products":120},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"hiddenlayer","HiddenLayer","\u002Fvendor-logos\u002Fhiddenlayer.png","hiddenlayer-ai-security","HiddenLayer AI Security Platform","https:\u002F\u002Fhiddenlayer.com\u002F","Model scanning, AI red teaming and runtime protection for AI applications.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",[146],{"slug":147,"name":148,"logo_path":149,"roles":150},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":168},"mcp-tool-poisoning-when-ai-agents-become-insider-threats","MCP Tool Poisoning: When AI Agents Become Insider Threats","MCP (Model Context Protocol) tool poisoning exploits the implicit trust AI agents place in the metadata and descriptions of their connected tools. By subtly altering tool descriptions, attackers can manipulate AI agents into performing unauthorized actions — such as exfiltrating data or executing fraudulent transactions — entirely outside the user's awareness. This is particularly dangerous in agentic, read-write workflows where AI systems have elevated permissions to act on behalf of users. The root problem mirrors classic supply chain and input validation failures: the AI agent consumes external tool definitions without sufficient integrity verification or runtime behavioral guardrails. As AI agents gain broader access to systems and data, the blast radius of a single poisoned tool grows dramatically.",[157,158,159,160,161,162,163,164,165,166,167],"NIST AI RMF: GOVERN 1.1 – Policies for AI risk management","NIST SP 800-161: Supply Chain Risk Management","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 16: Application Software Security","MITRE ATLAS: AML.T0010 – Poisoning of ML Supply Chain","OWASP LLM Top 10: LLM03 – Training Data Poisoning \u002F Tool Injection","GDPR Article 25: Data Protection by Design and by Default",{}]