Microsoft Flags Hidden-Instruction Injection in Already-Approved MCP Tools

Microsoft's Incident Response team warned on June 30, 2026 that in the Model Context Protocol (MCP) — the standard for connecting AI agents to external tools — a tool a user has already approved can later be rewritten to inject hidden malicious instructions. The tool name and the on-screen description stay identical, while only the tool's internal metadata field, its description, is updated to smuggle in text directing the agent to collect and exfiltrate sensitive data. Microsoft's write-up lays out a concrete example.