[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_U00h4qAtD9kBlnTknKghmyOwmwTPsDd1Ty410qOA8A":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"d6a3f753-9ef7-4297-8c20-1298946c0b56","mcp-tool-poisoning-when-ai-agents-become-insider-threats","213a54e8-4fbb-4746-9523-194819f4da7e","MCP Tool Poisoning: When AI Agents Become Insider Threats","MCP (Model Context Protocol) tool poisoning exploits the implicit trust AI agents place in the metadata and descriptions of their connected tools. By subtly altering tool descriptions, attackers can manipulate AI agents into performing unauthorized actions — such as exfiltrating data or executing fraudulent transactions — entirely outside the user's awareness. This is particularly dangerous in agentic, read-write workflows where AI systems have elevated permissions to act on behalf of users. The root problem mirrors classic supply chain and input validation failures: the AI agent consumes external tool definitions without sufficient integrity verification or runtime behavioral guardrails. As AI agents gain broader access to systems and data, the blast radius of a single poisoned tool grows dramatically.","**Immediate Actions:**\n- Audit all connected MCP tools and third-party integrations for unexpected or recently modified tool descriptions and metadata.\n- Restrict AI agent permissions to the minimum required scope, enforcing least-privilege access on all read-write workflows.\n\n**Long-term Improvements:**\n- Implement cryptographic signing and integrity verification for all tool definitions and plugin manifests consumed by AI agents.\n- Establish a formal vetting and approval process for any new tools or integrations added to AI agent environments.\n- Enforce separation of duties so AI agents operating in read-write modes require explicit human-in-the-loop approval for high-risk actions.\n\n**Detection Measures:**\n- Deploy behavioral monitoring to detect anomalous AI agent actions (e.g., unexpected data transfers, privilege escalations) that deviate from baseline workflows.\n- Maintain immutable audit logs of all actions taken by AI agents, including the tool invocations and metadata consumed at the time of execution.\n- Set up alerts for any modifications to tool descriptions or configuration files within AI agent orchestration frameworks.",[12,13,14,15,16,17,18,19,20,21,22],"NIST AI RMF: GOVERN 1.1 – Policies for AI risk management","NIST SP 800-161: Supply Chain Risk Management","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 16: Application Software Security","MITRE ATLAS: AML.T0010 – Poisoning of ML Supply Chain","OWASP LLM Top 10: LLM03 – Training Data Poisoning \u002F Tool Injection","GDPR Article 25: Data Protection by Design and by Default",{},"published","2026-06-30T18:21:48.471465+00:00","2026-06-30T18:21:48.358+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F06\u002F30\u002Fsecuring-ai-agents-ai-tools-move-from-reading-acting\u002F","securing-ai-agents-when-ai-tools-move-from-reading-to-acting-075d2f","Securing AI agents: When AI tools move from reading to acting",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":39,"name":40,"slug":41,"description":42,"color":43},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[52,56,60],{"slug":53,"name":54,"problem":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":57,"name":58,"problem":59},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":61,"name":62,"problem":63},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught."]