Overview
- Microsoft Incident Response published a July 2026 warning that attackers can hide instructions inside MCP tool descriptions, which agents read and follow before acting.
- The Model Context Protocol is an open standard that lets AI clients discover and call tools and resources via MCP servers, returning structured JSON so one server can serve many AI hosts.
- Developer SDKs and community servers have made MCP easy to deploy, and agent frameworks plus IDE copilots now commonly support MCP, speeding enterprise integration.
- Researchers at Invariant Labs and documented package-tamper incidents have shown this description-poisoning can exfiltrate credentials or copy outbound messages without a system breach.
- Practical mitigations include least-privilege access, local-only development servers, audit trails and data-lineage controls, but banks report adoption is outpacing these governance and runtime protections.