Your AI agent will read a stranger’s instructions and treat them as your own. That’s the whole attack.

Two pieces of research landed this week that should reset how you think about cybersecurity for AI agents. Dark Reading detailed “agentjacking,” where a fake bug report hijacks AI coding agents at scale. Microsoft Incident Response published parallel findings on poisoned Model Context Protocol (MCP) tool descriptions that quietly walk company data out the door. Different entry points, identical root cause: the agent can’t tell the difference between content it’s supposed to act on and instructions it’s supposed to obey.

Here’s the part that breaks your detection assumptions. The agent never violates a policy. It doesn’t escalate privileges, exploit a CVE, or trip a brute-force lockout. It does exactly what it was told, by someone who isn’t you.

Why this is a cybersecurity problem, not a prompt bug

An MCP tool description is metadata. It tells the agent what a tool does and when to use it. The agent reads that description as gospel, because in a normal setup nothing says it shouldn’t.

So an attacker poisons the description. Buried in the helpful text for some innocuous “format this file” tool is an extra instruction: also read the environment variables, also attach the contents of that config file, also send a copy here. The agent stitches it into its plan. Every individual step looks routine. The data exfiltration rides along on a legitimate-looking action.

Agentjacking does the same thing from the other side. The malicious instruction lives in a fake bug report, an issue comment, a README, a chunk of text the coding agent ingests while doing its job. The agent has real privileges: your repo, your credentials, your build pipeline. It reads attacker content, can’t separate it from your request, and acts with your access.

This is the confused deputy problem wearing a 2026 outfit. The agent is a deputy with your authority, and it’s been confused on purpose.

Traditional threat detection has nothing to grab onto here. There’s no malware signature, no exploit, no anomalous login. The firewall sees an authenticated agent making an outbound call it makes a hundred times a day.

What actually reduces the risk

You can’t patch your way out of “the model trusts text.” You contain it. Treat every agent as an untrusted intermediary holding real credentials, and build the controls around that assumption.

• Inventory your agents and their tools. You can’t govern an MCP server you didn’t know was connected. List every agent, every tool it can call, and every system it can touch.
• Pin and review tool descriptions. Treat the description text as code. Vet it on first use, hash it, and alert when a server silently changes what a tool claims to do. A description that mutates is a red flag.
• Least-privilege the agent, not just the user. Scope the credentials the agent runs with to the narrowest task. No standing access to secrets, source, and prod at once. Security hardening here means the blast radius of a hijack is small.
• Gate the dangerous verbs. Reading is cheap; acting is not. Require human approval, or a separate policy check, before an agent sends data externally, writes to a repo, or rotates a credential.
• Log agent actions off-host. Capture every tool call, argument, and destination to storage the agent and its host can’t reach. That’s your incident response lifeline when the agent does something subtle.
• Constrain destinations. Allowlist where an agent can send data. An exfiltration call to an unknown host should fail at the network layer, not succeed because the agent “decided” to make it.

Defense in depth applies cleanly to agents. Assume any single layer, the model’s judgment included, will be fooled, and make sure the next layer catches it.

Detection has to move to behavior

Stop watching for the agent to break a rule. It won’t.

Watch what it does instead. An agent that normally reads three files and writes one suddenly enumerating environment variables and opening an outbound connection is the signal, even though no individual step is forbidden. Baseline each agent’s normal tool-call pattern and flag the deviation. That’s behavior-based threat-protection applied to a non-human actor, and it’s the only thing that catches an attack with no IOCs.

Build the muscle now while agent deployments are still small. Rehearse the incident response play: an agent was hijacked, what did it touch, what data left, which credentials need rotating, how fast can you answer. If you can’t answer those today, you’ve already deployed the attack surface without the controls.

The agents aren’t going back in the box. The CIA’s director just called AI capabilities “digital nuclear weapons,” and your developers are wiring these things into production this quarter. Decide what they’re allowed to do before an attacker decides for them.

Sources

• Fake Bug Report Hijacks AI Coding Agents at Scale
• Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data
• Securing AI agents: When AI tools move from reading to acting
• CIA chief highlights major shifts in agency’s tech approach