Poisoned Tool Descriptions Turn Helpful AI Agents Into Quiet Exfiltration Channels

An AI agent that obeys every rule can still betray you.

That's the uncomfortable takeaway from new research by Microsoft Incident Response, which shows how attackers can hijack tool-using agents through nothing more exotic than a poisoned description string. The agent never violates policy. It never escalates privileges. It just follows instructions buried in a place defenders rarely inspect.

The technique sits in a category researchers have been circling for a while, sometimes tracked under the umbrella of indirect prompt injection and sometimes — in the Model Context Protocol ecosystem — as tool-description poisoning. The shape is consistent across writeups: untrusted text reaches the model through a channel the developer treated as configuration, not content.

Here, the bait is the tool manifest itself. When an agent enumerates available tools, it reads each tool's natural-language description to decide when to call it. An attacker who controls or tampers with that description can embed instructions the model treats as authoritative. Ask the agent to summarize a ticket, and the poisoned tool quietly suggests exfiltrating the conversation, attachments, or credentials to an attacker-controlled endpoint.

No exploit. No malware. No CVE.

Microsoft's researchers note that in a default configuration, each step of the abuse chain looks routine. The agent calls a tool it's allowed to call. It passes data it's allowed to read. The destination is whatever the tool's implementation forwards to. Logging, if it exists at all, captures a successful tool invocation rather than a policy violation.

That's the operational problem. Detection engineering for agent ecosystems is immature, and most telemetry today answers "did the agent do something forbidden?" rather than "did the agent do something a reasonable human would have refused?"

A few things worth flagging for defenders thinking about this class of issue:

• Treat tool descriptions, schemas, and metadata as untrusted input on the same tier as user prompts. They are content, not config.
• Pin and review third-party MCP servers and agent plugins the way you'd review a software dependency, including diffs on description fields between versions.
• Constrain egress from agent runtimes. An agent that can reach arbitrary outbound destinations is an exfiltration primitive waiting for a prompt.
• Instrument for semantic anomalies — unusual data volumes, unfamiliar tool chains, calls that mix sensitive readers with external writers in a single session.

Attribution-wise, this is capability research rather than an observed intrusion set, and Microsoft frames it that way. But the gap between published technique and in-the-wild adoption keeps shrinking for agent abuse. Tool-description poisoning is cheap, portable, and survives model upgrades because it doesn't target the model — it targets the trust the model places in its own toolbelt.

The shorter version: agents don't need to be jailbroken if their tools can lie to them.