how it happened
- whoattackerwrites a tool description
- the gapAI agenttrusts tool descriptions
- the resultnew attack classacross connectors
what everyone assumed
A tool description feels like a label, metadata for the human, inert plumbing for the machine. The assumption is that the attack surface is the tool’s behavior, not the words that introduce it.
what happened
Hidden instructions in tool descriptions, invisible in the interface but read by the model, could coerce agents into reading files or leaking data. Separately, flaws in an official connector implementation enabled code execution and data exposure. The text itself was the payload.
step by step
- agents read tool descriptions they are givenAnd trust them.
- hidden instructions sit in those descriptionsInvisible in the interface, read by the model.the assumption breaks here
- April 2025researchers show agents leaking filesTool poisoning across the connector ecosystem.
- later 2025flaws in an official connectorCode execution and data exposure.
how it surfaced
In April 2025 researchers disclosed tool poisoning across the emerging connector ecosystem, and later in the year multiple vulnerabilities were found in a widely used official connector. The class of attack lives in the descriptions agents trust.
For an AI agent, a tool’s description is an instruction it reads, which makes the description an attack surface.
Anything the model ingests can carry a command, including the metadata that was supposed to be inert.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA tool description contains hidden instructions to send files elsewhere.what it costs youThe agent follows them, because to the AI it looked like part of the job.
- or it goes like thisit happenedEchoLeak / Microsoft 365 Copilot, 2025howAn email with hidden instructions reaches an assistant that reads every inbox.what leavesanything the assistant can seewho ends up with itthe stranger who sent the email
- or it goes like thisit happenedReplit agent database deletion, 2025howAn agent with production access ignores the instruction to change nothing.what leavesthe live database, deletedwho ends up with ityour customers, who notice first
sources
your turn
what you can do about it
this week
List which AI agents hold which tool connections, and treat each as standing access.
As your teams connect AI agents to real tools, each connector ships with text the model trusts and you have not audited. MCP tool poisoning is why that text matters. Knowing which agents hold which connections, and treating each like the standing access it is, is where this goes.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →