On June 30, 2026, Microsoft Incident Response and Defender researchers published a case walkthrough with the title "When AI tools move from reading to acting." It traces one pattern through four phases: a tool description silently modified on the MCP server side; the agent dynamically re-trusting the changed tool without asking for approval again; the agent executing according to the new description; and exfiltration through a call the policy had already approved.
Why a description is an attack surface
The model reads tool descriptions to decide what a tool does and when to call it. Those descriptions are text supplied by the server, and they enter the context window with the same authority as the system prompt. The model believes it is calling a search function. The tool exfiltrates data. Invariant Labs first disclosed the technique in April 2025; it has since been assigned CVE-2025-54136 in one implementation and appears as ASI02 and ASI04 in the OWASP Agentic Top 10. Academic measurement in 2026 found tool poisoning in roughly 5.5 percent of 1,899 surveyed servers.
The part vendors keep getting wrong
The approval model in most agent clients treats a server as trusted once. When the server changes what its tools say, the client re-fetches the descriptions and proceeds. Microsoft's phase two, dynamic re-trust without re-approval, is where the security decision the operator thought they made stops applying. The fix is a re-approval on change, and several clients now do it. The gap in the meantime is a network one.
What to do
- 01Pin tool descriptions. Hash them at approval and require re-approval when the hash changes; prefer clients that already do this.
- 02Run MCP servers under a separate egress policy from the agents that call them, with Default Action Deny and a long hold.
- 03Log the destinations each MCP host reaches and review the first-seen queue for that policy weekly.
- 04Treat every third-party MCP server as an untrusted dependency. There is no certification program as of mid-2026.