Microsoft’s security researchers have effectively drawn a line in the sand for companies rushing to deploy AI agents. The problem isn’t the code. It’s the plain-text descriptions that tell these agents what to do.
Those descriptions can be poisoned. And once they are, the agent doesn’t just produce bad output.
It performs bad actions. The work, published June 30 by Microsoft Incident Response and its Defender team, lands at an awkward moment. Companies are handing AI agents real power.
Microsoft 365 Copilot can send email, create files, and change calendars. Custom agents built in Copilot Studio or Azure AI Foundry can reach into business systems and run multi-step jobs on their own.
The same injection trick that once biased a summary now triggers an action. Against a reader, an attack changes the output. Against an agent, it changes what the software actually does.
The weak point is the Model Context Protocol, or MCP. Microsoft calls it an open protocol that lets an AI call outside tools the way an app calls an API. The company describes MCP as the fastest-growing part of the agentic AI supply chain.
That makes it an expanding attack surface. Every MCP tool ships with a description — a few lines of plain text that tell the agent what the tool does and when to use it.
The agent reads that text to decide how to act. That is the whole weakness. The description is just words, and words can carry instructions.
Microsoft walks through the problem with an invoice example. No named victim here.
The scenario is built to show the pattern. A finance team stands up an agent to handle vendor invoices. The agent reads the tool description and decides which database to query, which email to send.
An attacker poisons that description. The agent now reads a different set of instructions. It quietly hands over company data.
The company never sees it happen. The policy question is blunt.
Who writes the rules for agent descriptions? Who audits them? Right now, the answer is nobody.
Companies are deploying agents that read plain text and act on it. That text can come from anywhere.
A vendor-supplied tool. A user-uploaded document. A compromised email attachment.
The description is just words, and words can carry instructions. Microsoft’s researchers are effectively telling the industry to stop treating agent descriptions as metadata. Treat them as code.
That means version control. Change management.
Access controls. The same discipline applied to software libraries needs to apply to the plain-text descriptions that tell agents what to do. It’s a boring answer.
It’s also the only one that works. The timing matters.
Companies are just beginning to let AI do more than read and summarize. Until recently, the workplace AI risk was mostly framed around what a model read and wrote. A poisoned document could skew an answer, and that was mostly where it ended.
Agents are different. They act. And when the description that guides their action is poisoned, the action is poisoned too.
Microsoft’s warning is not a bug report. It’s a policy brief.
The rules for agent deployment need to change. The descriptions that tell agents what to do need the same scrutiny as the code that runs them. The alternative is a finance team that never sees the data leak happening.
The agent just follows the words it was given.
