As enterprise deployments mature, some enterprise AI agents are shifting from reading content to taking action. In this post, Microsoft Incident Response walks through an attack pattern that targets the fastest growing part of the agentic AI supply chain: Model Context Protocol (MCP) tools. The post provides a practical playbook for detecting, containing, and preventing this class of attack using Microsoft security controls.随着企业部署的成熟，一些企业 AI 智能体正在从阅读内容转向采取行动。在本文中，Microsoft 事件响应团队将剖析一种攻击模式，该模式针对的是智能体 AI 供应链中增长最快的部分：模型上下文协议 (MCP) 工具。本文提供了一套实用的手册，指导如何使用 Microsoft 安全控制措施来检测、遏制和预防此类攻击。
From reading to acting从阅读到行动
This is the third post in the AI Application Security series. AI Application Series 1: Security considerations when adopting AI tools examined how AI adoption expands the enterprise attack surface. AI Application Series 2: Detecting and analyzing prompt abuse in AI tools showed how indirect prompt injection can bias the output of a passive AI summarizer. In both cases, the AI only read content and produced text, it did not take action. This post addresses what happens when that boundary changes.这是“AI 应用安全”系列的第三篇文章。AI 应用系列 1：采用 AI 工具时的安全考量，探讨了 AI 的采用如何扩大企业攻击面。AI 应用系列 2：检测和分析 AI 工具中的提示词滥用，展示了间接提示词注入如何影响被动式 AI 摘要工具的输出。在这两种情况下，AI 仅读取内容并生成文本，并未采取行动。本文将探讨当这一界限发生变化时会发生什么。
AI agents can plan multi-step tasks, decide which tools to invoke, and execute actions on behalf of the user. Microsoft 365 Copilot can draft and send email, create documents, and update calendar entries. Copilot Studio and Azure AI Foundry allow organizations to build custom agents that connect to business systems through MCP. As AI is increasingly used in read-write workflows, the impact profile of vulnerabilities may shift. A prompt injection against a summarizer can bias an output. A prompt injection against an agent can trigger an action.AI 智能体可以规划多步骤任务、决定调用哪些工具，并代表用户执行操作。Microsoft 365 Copilot 可以起草和发送电子邮件、创建文档以及更新日历条目。Copilot Studio 和 Azure AI Foundry 允许组织构建自定义智能体，通过 MCP 连接到业务系统。随着 AI 越来越多地用于读写工作流，漏洞的影响范围可能会发生变化。针对摘要工具的提示词注入可能会影响输出结果，而针对智能体的提示词注入则可能触发实际操作。
According to the International Data Corporation (IDC), the number of active AI agents in enterprises is projected to grow from 28.6 million in 2025 to more than 2.2 billion by 2030. That scale is why the OWASP Top 10 for Agentic Applications, released in December 2025, now sits alongside the LLM Top 10 as a reference framework for defenders. This post focuses on one of its fastest-moving categories: tool misuse and agentic supply chain risk exploited through poisoned MCP tool metadata.根据国际数据公司 (IDC) 的数据，企业中活跃的 AI 智能体数量预计将从 2025 年的 2860 万增长到 2030 年的超过 22 亿。正是由于这种规模，2025 年 12 月发布的《OWASP 智能体应用十大安全风险》现在与《LLM 十大安全风险》并列，成为防御者的参考框架。本文重点关注其发展最快的类别之一：工具滥用以及通过中毒的 MCP 工具元数据利用的智能体供应链风险。
Attack pattern: MCP tool poisoning in a finance workflow攻击模式：金融工作流中的 MCP 工具中毒
The pattern below maps to ASI02 – Tool Misuse and ASI04 – Agentic Supply Chain Vulnerabilities. It reflects techniques first disclosed by Invariant Labs in April 2025 and observed in 2026 against a growing range of enterprise agents.以下模式对应于 ASI02 – 工具滥用和 ASI04 – 智能体供应链漏洞。它反映了 Invariant Labs 于 2025 年 4 月首次披露并在 2026 年针对一系列日益增长的企业智能体中观察到的技术。
The environment环境
A financial operations team builds a Copilot Studio agent to help analysts handle vendor invoices. The agent has generative orchestration enabled and connects to three tools: a Dataverse MCP server holding the approved vendor master, an Outlook connector for vendor correspondence, and a third-party invoice enrichment MCP server added to validate banking details against an external reference database. The third-party server is reviewed by the team’s service owner lead and approved for production use. No separate security review is performed.一个财务运营团队构建了一个 Copilot Studio 智能体，以帮助分析师处理供应商发票。该智能体启用了生成式编排，并连接到三个工具：一个持有已批准供应商主数据的 Dataverse MCP 服务器、一个用于供应商通信的 Outlook 连接器，以及一个第三方发票充实 MCP 服务器（用于根据外部参考数据库验证银行详细信息）。该第三方服务器由团队的服务所有者主管审查并批准用于生产环境。未执行单独的安全审查。
Attack chain overview攻击链概述
Phase 1: Tool description poisoning. A developer pushes an update to the enrichment server. The tool name and user-facing summary remain unchanged, but the MCP tool description is silently modified. This description is the natural-language metadata the agent reads to decide how and when to call the tool. Buried within what appears to be legitimate formatting guidance is a hidden block of instructions directing the agent to retrieve the last thirty unpaid invoices, summarize them, and attach that summary as an additional parameter in the enrichment call—framed as a fraud-heuristic requirement.阶段 1：工具描述中毒。开发人员向充实服务器推送更新。工具名称和面向用户的摘要保持不变，但 MCP 工具描述被静默修改。此描述是智能体读取的自然语言元数据，用于决定如何以及何时调用该工具。在看似合法的格式化指南中，隐藏了一块指令，指示智能体检索最后三十张未付发票，对其进行汇总，并将该摘要作为充实调用中的附加参数进行附加——将其伪装成欺诈启发式需求。
Phase 2: Silent re-trust.The MCP reflects tool metadata updates dynamically. In configurations where description changes do not trigger a re-approval workflow, the updated instructions become active without additional review. The poisoned description is live in production.阶段 2：静默重新信任。MCP 会动态反映工具元数据的更新。在描述更改不会触发重新批准工作流的配置中，更新后的指令无需额外审查即可生效。中毒的描述在生产环境中处于活动状态。
Phase 3: User invocation. A financial analyst asks the agent a routine question about a supplier. Without any visible indication, the agent follows the hidden instructions embedded in the poisoned tool description, collecting sensitive financial records beyond the scope of the original request and forwarding them as part of the enrichment call, as if it were a normal part of the request.阶段 3：用户调用。财务分析师向智能体询问有关供应商的常规问题。在没有任何可见迹象的情况下，智能体遵循嵌入在中毒工具描述中的隐藏指令，收集超出原始请求范围的敏感财务记录，并将它们作为充实调用的一部分转发，就好像它是请求的正常部分一样。
Phase 4: Exfiltration. The enrichment server returns a plausible “validated” response and silently logs the attached invoice summary to a threat actor-controlled endpoint. The analyst sees a clean answer. No alert may fire in default configurations. Every individual action the agent took was within its normal operating parameters. This pattern does not exploit a vulnerability in Copilot itself, but rather a trust boundary introduced by external tool integrations.阶段 4：数据外泄。充实服务器返回一个看似合理的“已验证”响应，并静默地将附加的发票摘要记录到攻击者控制的端点。分析师看到的是一个干净的答案。在默认配置下，可能不会触发任何警报。智能体采取的每一项单独行动都在其正常操作参数范围内。这种模式不是利用 Copilot 本身的漏洞，而是利用外部工具集成引入的信任边界。
Why this pattern is effective为什么这种模式有效
Each action the agent takes on its own is legitimate. The tool is approved, the Dataverse query inherits the analyst’s permissions, and the outbound call goes to a server that was allowlisted when it was added. The vulnerability is not in any single system; it is in the trust boundary between them.The MCP blends instructions (tool descriptions) with data, so a change to a tool’s metadata can redirect the agent’s behavior as effectively as a change to its system prompt. The agent cannot distinguish between a legitimate instruction authored by its owner and a malicious instruction inserted by an upstream maintainer.智能体采取的每一项行动本身都是合法的。工具已获批准，Dataverse 查询继承了分析师的权限，出站调用发送到添加时已列入允许列表的服务器。漏洞不在于任何单一系统，而在于它们之间的信任边界。MCP 将指令（工具描述）与数据混合在一起，因此更改工具的元数据可以像更改系统提示词一样有效地重定向智能体的行为。智能体无法区分其所有者编写的合法指令和上游维护者插入的恶意指令。
Mitigation and protection guidance缓解和保护指南
Detection and response with Microsoft security tools使用 Microsoft 安全工具进行检测和响应
The controls mapped in Figure 1 apply at four points in the attack chain, each supported by a specific Microsoft capability:图 1 中映射的控制措施适用于攻击链的四个点，每个点都由特定的 Microsoft 功能支持：
- Govern the supply chain. Maintain a tenant-level allowlist of approved MCP publishers and servers. The Microsoft MCP catalog provides a list of first-party servers, review and assess where provenance is verifiable. Disable Allow all on MCP connections and enable only the specific tools an agent needs.治理供应链。维护租户级别的已批准 MCP 发布者和服务器允许列表。Microsoft MCP 目录提供了第一方服务器列表，请审查并评估来源可验证的位置。禁用 MCP 连接上的“全部允许”，仅启用智能体所需的特定工具。
- Inspect tool metadata. Use Prompt Shields in Azure AI Content Safety to inspect content flowing from MCP tool responses and descriptions into agent context. Defender for Cloud’s AI workload protection alerts on suspicious prompts and tool outputs at runtime. Review metadata changes to production tools with the same rigor as changes to system prompts.检查工具元数据。使用 Azure AI 内容安全中的提示词防护 (Prompt Shields) 来检查从 MCP 工具响应和描述流入智能体上下文的内容。Defender for Cloud 的 AI 工作负载保护会在运行时针对可疑提示词和工具输出发出警报。以与更改系统提示词相同的严谨度审查生产工具的元数据更改。
- Guard the action. Microsoft Purview Data Loss Prevention (DLP) policies inspect tool call parameters and can block sensitive data in outbound payloads. For high-impact actions such as financial data access, external sharing, or account changes, configure human-in-the-loop approval through Copilot Studio. Assign each agent a non-human identity in Microsoft Entra Agent ID and apply Conditional Access to its workload identity.守护行动。Microsoft Purview 数据丢失防护 (DLP) 策略会检查工具调用参数，并可以阻止出站负载中的敏感数据。对于财务数据访问、外部共享或账户更改等高影响操作，请通过 Copilot Studio 配置人工审批。为每个智能体在 Microsoft Entra Agent ID 中分配一个非人类身份，并对其工作负载身份应用条件访问。
- Correlate the chain. When MCP server telemetry is instrumented and forwarded to Microsoft Sentinel, it can be correlated against agent behavior signals to flag anomalous sequences. Microsoft Defender for Cloud Apps surfaces new external endpoints an agent has started interacting with. Microsoft Purview audit logs provide the evidence trail for investigation and post-incident review.关联攻击链。当 MCP 服务器遥测数据被检测并转发到 Microsoft Sentinel 时，可以将其与智能体行为信号相关联，以标记异常序列。Microsoft Defender for Cloud Apps 会显示智能体开始交互的新外部端点。Microsoft Purview 审计日志为调查和事后审查提供了证据链。
Three principles for agent supply chain governance智能体供应链治理的三项原则
Treat every MCP server as part of the supply chain. Every MCP server an agent can call is a production dependency. Maintain an inventory of approved publishers, review tool descriptions during security review rather than relying on tool names alone, and require a documented owner for any third-party server before production use.将每个 MCP 服务器视为供应链的一部分。智能体可以调用的每个 MCP 服务器都是生产依赖项。维护已批准发布者的清单，在安全审查期间审查工具描述，而不是仅依赖工具名称，并要求在生产使用前为任何第三方服务器指定记录在案的所有者。
Treat tool descriptions as system prompts. Because models can read tool metadata as part of their working context, a change to that metadata is equivalent to a change in agent instructions. Require change review for tool description updates on critical agents and use Prompt Shields to inspect metadata for imperative language that does not belong in a documentation field.将工具描述视为系统提示词。由于模型可以将工具元数据作为其工作上下文的一部分进行读取，因此对该元数据的更改等同于对智能体指令的更改。要求对关键智能体上的工具描述更新进行变更审查，并使用提示词防护来检查元数据中是否存在不属于文档字段的命令性语言。
Apply least agency, not just least privilege. There are important factors to consider for permissions. Even a minimally permissioned agent can cause harm if it has too much autonomy. Turn off Allow all tool access, require human approval for high-impact actions, and establish baseline agent behaviors in Microsoft Sentinel so that deviations from the norm—such as new endpoints, expanded parameters, or unusual query patterns—trigger alerts.应用最小智能体权限，而不仅仅是最小特权。在权限方面有重要的因素需要考虑。即使是权限最小的智能体，如果拥有过多的自主权，也可能造成损害。关闭“全部允许”工具访问，要求对高影响操作进行人工审批，并在 Microsoft Sentinel 中建立基准智能体行为，以便偏离常态的行为（例如新端点、扩展参数或异常查询模式）触发警报。
Conclusion结论
Agents that act on behalf of users depend on a supply chain of tools that is growing as governance programs continue to evolve. A threat actor who modifies a tool description may influence agents that rely on it, even without directly involving a user, a prompt, or a credential. The OWASP Top 10 for Agentic Applications provides the framework.代表用户行动的智能体依赖于一个工具供应链，随着治理计划的不断演进，该供应链正在不断增长。修改工具描述的威胁行为者可能会影响依赖它的智能体，即使没有直接涉及用户、提示词或凭据。OWASP 智能体应用十大安全风险提供了相应的框架。
Microsoft security capabilities—including Copilot Studio guardrails, Prompt Shields, Defender for Cloud AI Protection, Microsoft Entra Agent ID, Microsoft Purview DLP, Microsoft Defender for Cloud Apps, and Microsoft Sentinel—provide the controls. What remains is to apply them deliberately to agentic workflows: scope permissions, govern the tool supply chain, monitor agent behavior, and perform red teaming exercises before deployment.Microsoft 安全功能（包括 Copilot Studio 防护栏、提示词防护、Defender for Cloud AI 保护、Microsoft Entra Agent ID、Microsoft Purview DLP、Microsoft Defender for Cloud Apps 和 Microsoft Sentinel）提供了控制措施。剩下的工作是将它们有意识地应用于智能体工作流：限定权限范围、治理工具供应链、监控智能体行为，并在部署前进行红队演练。
References参考资料
- IDC FutureScape 2026 Predictions Reveal the Rise of Agentic AI and a Turning Point in Enterprise Transformation. IDC (accessed 2026-06-03)IDC FutureScape 2026 预测揭示了智能体 AI 的兴起以及企业转型的转折点。IDC（访问日期：2026-06-03）
- OWASP GenAI Security Project Releases Top 10 Risks and Mitigations for Agentic AI Security. OWASP Gen AI Security Project (accessed 2026-06-03)OWASP GenAI 安全项目发布智能体 AI 安全的十大风险和缓解措施。OWASP Gen AI 安全项目（访问日期：2026-06-03）
- MCP Security Notification: Tool Poisoning Attacks. Invariant Labs (accessed 2026-06-03)MCP 安全通知：工具中毒攻击。Invariant Labs（访问日期：2026-06-03）
Microsoft follows coordinated disclosure practices and is not disclosing details of any specific affected organization.Microsoft 遵循协调披露实践，不会披露任何特定受影响组织的详细信息。
This research is provided by Microsoft Defender Security Research, Mohammed Zaid, and with contributions from members of Microsoft Threat Intelligence.本研究由 Microsoft Defender 安全研究团队、Mohammed Zaid 提供，并得到了 Microsoft 威胁情报团队成员的贡献。
Learn more了解更多
For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.有关来自 Microsoft 威胁情报社区的最新安全研究，请查看 Microsoft 威胁情报博客。
To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.要获取有关新出版物的通知并参与社交媒体上的讨论，请在 LinkedIn、X（前身为 Twitter）和 Bluesky 上关注我们。
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.要聆听来自 Microsoft 威胁情报社区关于不断演变的威胁形势的故事和见解，请收听 Microsoft 威胁情报播客。
Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization. 查看我们的文档以了解更多关于我们实时保护功能的信息，并了解如何在您的组织内启用它们。
- Microsoft 365 Copilot AI security documentation Microsoft 365 Copilot AI 安全文档
- How Microsoft discovers and mitigates evolving attacks against AI guardrails Microsoft 如何发现并缓解针对 AI 防护栏的不断演变的攻击
- Learn more about securing Copilot Studio agents with Microsoft Defender 了解更多关于使用 Microsoft Defender 保护 Copilot Studio 智能体的信息
- Evaluate your AI readiness with our latest Zero Trust for AI workshop.通过我们最新的“AI 零信任”研讨会评估您的 AI 就绪程度。
- Learn more about Protect your agents in real-time during runtime (Preview)了解更多关于在运行时实时保护您的智能体（预览版）的信息
