Securing AI agents: When AI tools move from reading to acting

As AI agents expand from simply reading and summarizing content to taking real-world actions like sending emails or updating records, they become targets for a new type of attack called MCP tool poisoning (where attackers modify the instructions embedded in tool descriptions to trick agents into unintended actions). Microsoft describes how attackers can silently alter the natural-language metadata that tells an agent how to use a tool, and if configuration doesn't require re-approval when descriptions change, the poisoned instructions go live in production without detection.