Microsoft Researchers Show AI Agents Can Be Manipulated via Poisoned Tool Descriptions

·1 views

Microsoft's incident response team has demonstrated that AI agents can be tricked into leaking sensitive data by embedding malicious instructions inside MCP tool descriptions — the metadata agents rely on to decide which tools to use. Because each individual action the compromised agent takes appears routine and rule-compliant, the attack is largely invisible to conventional security monitoring systems like SIEMs. The vulnerability stems from the Model Context Protocol, a widely used standard for assembling agentic AI systems, where tool metadata is trusted by design and rarely audited. Security experts warn this is less a novel attack category and more a supply chain risk applied to AI orchestration — one that most teams building agentic pipelines are not yet accounting for. Addressing the threat requires treating tool registries and descriptions with the same scrutiny as user input, and shifting AI observability toward cross-session behavioral pattern analysis rather than per-action rule matching.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Splitting Tasks Across Multiple AI Agents Reduces Production Failures

A development team discovered the limits of single-agent AI systems when their document analysis agent hallucinated during validation roughly 15% of the time in production, caused by overloading one context window with too many roles. Their solution was to split the workflow into multiple specialised agents, each handling a single task such as research, validation, or summarisation. The team uses Celery for orchestration, with an orchestrator agent directing worker agents that operate independently without sharing conversation history. This isolation is intentional, as it prevents errors from cascading between steps and keeps each agent's instructions focused. Output between agents is schema-validated using Pydantic to catch silent failures before they propagate downstream.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP Registries Solve the N×M Integration Problem Plaguing Multi-Agent Teams

As engineering teams scale their use of Model Context Protocol (MCP) servers, managing individual connection configs and credentials across dozens of developers quickly becomes unmanageable. The core issue is the N×M integration problem: with N agents and M servers connected directly, the number of integration points multiplies rapidly, reaching nearly 1,900 manual config entries at larger team sizes. An MCP registry acts as a centralized catalog storing each server's identity, connection details, authentication metadata, tool schemas, and access policies in one authoritative place. This design means credential rotation requires updating a single registry record rather than hunting down every developer's local config file. Role-based access control within the registry also governs which users, teams, or agents are permitted to discover and call specific tools, replacing ad-hoc permission management across disparate systems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Chennai .NET Developer Shares Hard Lessons from Two Years in Production

A .NET developer based in Chennai has shared candid reflections on the steep learning curve faced after joining their first software job, despite feeling well-prepared after college. Early work on an HRMS system exposed critical gaps in writing performant SQL, handling N+1 query problems, and understanding real-world database optimization. A biometric hardware integration task further revealed that production bugs often stem from infrastructure or network configuration rather than application code. By the one-year mark, the developer recognized a clear gap between writing working code and writing good, optimized code, prompting a deliberate effort to improve skills in areas like EF Core and query performance. The account highlights how real-world software development — with its interconnected systems, legacy code, and live users — demands a fundamentally different skill set than academic projects.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds 2D physics engine in C++ and SDL2 using Separating Axis Theorem

A developer has built a 2D physics engine from scratch in C++ and SDL2, deliberately avoiding external physics libraries to deeply understand collision detection. The project uses the Separating Axis Theorem (SAT), which determines whether two convex shapes collide by checking if any axis exists where their projections do not overlap. Key implementation challenges included ensuring collision normals point in the correct direction and applying mass-weighted positional correction so lighter objects move more than heavier ones during collisions. The current engine tests every entity pair each frame, resulting in O(n²) complexity that limits scalability beyond a few dozen shapes. The developer plans to add spatial partitioning, true angular velocity, and eventually integrate the engine into a tile-based game, with source code available on GitHub.

0 comments Read more at DEV Community