--- id: CP-264 slug: ai-agents-tool-use-mcp lang: en title: AI agents, tool use and MCP description: "An AI agent calls tools on your behalf: mail, files, APIs. What it can get wrong, and how to limit its rights." canonical_url: https://startbrain.io/cyberpedia/en/articles/ai-agents-tool-use-mcp/ markdown_url: https://startbrain.io/cyberpedia/en/articles/ai-agents-tool-use-mcp.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "AI agents, tool use and MCP", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/ai-agents-tool-use-mcp/ (CC BY 4.0) wing: 4 theme: master_ai reflex: air-048 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/ai-agents-tool-use-mcp/ fr: https://startbrain.io/cyberpedia/fr/articles/agents-ia-outils-mcp/ de: https://startbrain.io/cyberpedia/de/articles/ki-agenten-werkzeuge-mcp/ es: https://startbrain.io/cyberpedia/es/articles/agentes-ia-herramientas-mcp/ sources: - "n": 1 title: "Toolformer: Language Models Can Teach Themselves to Use Tools" publisher: arXiv url: https://arxiv.org/abs/2302.04761 published: "2023-02-09" accessed: "2026-11-03" - "n": 2 title: "ReAct: Synergizing Reasoning and Acting in Language Models" publisher: arXiv url: https://arxiv.org/abs/2210.03629 published: "2022-10-06" accessed: "2026-11-03" - "n": 3 title: LLM06:2025 Excessive Agency publisher: OWASP url: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/ accessed: "2026-11-03" - "n": 4 title: LLM01:2025 Prompt Injection publisher: OWASP url: https://genai.owasp.org/llmrisk/llm01-prompt-injection/ accessed: "2026-11-03" - "n": 5 title: "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection" publisher: arXiv url: https://arxiv.org/abs/2302.12173 published: "2023-02-23" accessed: "2026-11-03" - "n": 6 title: Prompt injection is not SQL injection (it may be worse) publisher: NCSC (UK) url: https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection published: "2025-12-08" accessed: "2026-11-03" - "n": 7 title: "Technical Blog: Strengthening AI Agent Hijacking Evaluations" publisher: NIST url: https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations published: "2025-01-17" accessed: "2026-11-03" - "n": 8 title: Security and governance - Microsoft Copilot Studio publisher: Microsoft url: https://learn.microsoft.com/en-us/microsoft-copilot-studio/security-and-governance accessed: "2026-11-03" --- # AI agents, tool use and MCP An AI agent is a language model that has been given tools: reading a mailbox, opening files, browsing a website, calling an API. Research papers from 2022 and 2023 describe models trained to decide which APIs to call, when to call them and with which arguments [1], or prompted with a few examples to alternate between reasoning and actions and to consult external sources [2]. OWASP, which maintains the list of the main risks for applications built on language models, speaks of "agency": the ability to call functions or interact with other systems through extensions, which vendors also call tools, skills or plugins. The choice of which extension to run can be left to the agent itself, which decides based on the request or on the result of a previous call [3]. For an employee, the question becomes simple: what can this agent do in my name, and who checks before it is done? ## In 30 seconds - Where it happens: in any assistant that reads your emails, your documents or web pages and can act (send or delete) without you clicking at each step [3]. - What the attacker wants: to slip an instruction into content the agent will read, so that it acts on the attacker's behalf, for example by forwarding sensitive emails [3]. - The reflex: give the agent the bare minimum of rights, require your approval before any action with an effect (sending, deleting, publishing) and review what it has prepared [3]. - If it has already happened: tell your security team, with the date and the tools connected to the agent at that time. Tool activity logs are used to spot abnormal actions [3]. ## Straight answers ### What distinguishes an agent from a simple chat assistant? A chat assistant answers. An agent acts: it makes repeated calls to the model, relying on the result of earlier calls to guide the next ones [3]. Each tool that is plugged in widens what a mistake or a manipulation can cause. ### What is the MCP protocol? The sources gathered for this entry do not describe MCP. They deal with tools, extensions and connectors in general, and the risks described below apply to any way of connecting an agent to a tool. The protocol itself is therefore not detailed here. ### What is an indirect prompt injection? It is the case where the model receives instructions hidden in external content, such as a website or a file, and changes its behavior because of them [4]. Researchers showed in 2023 that this route allows remote attacks, without a direct interface, on applications that integrate a model, by placing the instructions in data likely to be retrieved [5]. The attacker does not need access to the AI: they write something that will end up being read by it [6]. The text can even be invisible to a human, as long as the model interprets it [4]. ### Can these attacks be blocked with a filter? Not completely. OWASP considers it unclear whether foolproof prevention exists [4]. The UK NCSC explains that current models make no distinction between instructions and data: they only predict the next word. It estimates that prompt injection may never be fully fixed, unlike SQL injection, and recommends reducing the risk and the impact [6]. It also warns against products that claim to "stop" prompt injection [6]. ### What should I review before letting the agent act? Anything that leaves your perimeter: emails sent or files shared. OWASP gives the example of an email-sending tool where the user reviews and approves each message drafted by the agent [3]. ## How it works An application gives the model a set of tools, then lets the model choose which ones to call [3]. The developer's instructions and the content to process (an email, a page, a file) arrive in a single input. Current agents generally rely on this mix of trusted instructions and untrusted data [7]. The NCSC draws a practical consequence from this. When the agent calls tools or APIs based on what the model says, an attacker who manipulates the model gets the equivalent of direct access to those tools, with the worst-case scenario that this implies [6]. ## What you do OWASP lists the measures that reduce an agent's excess of power. You do not always control their configuration, but you can request them from the team deploying the tool. - Reduce the tools: if the agent does not need to read a web address, it is not given that function [3]. - Reduce the functions: an extension that summarizes emails only needs to read them, not delete them or send any [3]. - Prefer precise tools to open-ended ones, such as "run a command": with the latter, any other command can be launched [3]. - Reduce the permissions: a tool that reads a database must not connect with an identity that can also modify or delete [3]. - Act with your own rights, not with a generic, highly privileged account. For a code repository, OWASP cites an OAuth connection with the minimum scope [3]. - Require human approval for high-impact actions [3]. - Log tool activity to spot abnormal actions, and limit the rate to reduce the number of unwanted actions possible in a given period [3]. The NCSC offers a simple rule: when a model processes information coming from a third party, its privileges drop to those of that third party. An agent that reads emails from outside people must therefore not have access to privileged tools [6]. On the platform side, Microsoft describes administrator-only controls for Copilot Studio: data policies on connectors, actions and HTTP requests, analysis of connector dependencies before deployment, audit logs, and the option to disable publishing of agents that use generative AI. Agent designers can also configure tools to run with the user's credentials [8]. ## Pitfalls - The agent with excessive rights. OWASP distinguishes three causes: too much functionality, too many permissions, too much autonomy [3]. An extension tried out during development, then abandoned, can remain accessible to the agent [3]. A third-party extension chosen to read documents can also be able to modify and delete them [3]. - The instruction hidden in an email. In OWASP's example, a booby-trapped incoming email pushes a mail assistant to search the inbox and forward sensitive information to the attacker [3]. - The image that leaks the conversation. A user asks the AI to summarize a page containing hidden instructions, which make it insert an image pointing to an address: the private conversation leaves that way [4]. - The altered document in a knowledge base. If an attacker alters a document used by a retrieval-augmented application, the AI's answer can become misleading [4]. - The chaining between tools. An injection can come from an earlier call to a compromised extension, or from another compromised agent in a multi-agent system [3]. - The single test that falsely reassures. NIST notes that a model can resist known attacks and yield to attacks designed for it [7]. ## Real cases ### February 2023: a demonstration on Bing Chat and code assistants Researchers, including Kai Greshake and Sahar Abdelnabi, submitted a paper on 23 February 2023 showing indirect injection attacks against real systems, including the GPT-4-based Bing Chat and code-completion engines. According to them, processing a retrieved prompt can amount to arbitrary code execution and can control whether and how other APIs are called. They note a lack of effective defenses at that time [5]. ### January 2025: NIST's agent hijacking evaluation On 17 January 2025, NIST's Center for AI Standards and Innovation published its agent hijacking tests on the AgentDojo framework. Attacks designed specifically for the tested model rose from an 11% success rate (the best baseline attack) to 81% [7]. Across five injection tasks, including sending an authentication code to a third party and running a malicious script, the average success rate was 57% with one attempt, and 80% with 25 attempts per attack [7]. These were simulated environments, not incidents in a company [7]. ## Sources 1. arXiv, "Toolformer: Language Models Can Teach Themselves to Use Tools", 9 February 2023. https://arxiv.org/abs/2302.04761 (accessed 3 November 2026) 2. arXiv, "ReAct: Synergizing Reasoning and Acting in Language Models", 6 October 2022. https://arxiv.org/abs/2210.03629 (accessed 3 November 2026) 3. OWASP, "LLM06:2025 Excessive Agency". https://genai.owasp.org/llmrisk/llm062025-excessive-agency/ (accessed 3 November 2026) 4. OWASP, "LLM01:2025 Prompt Injection". https://genai.owasp.org/llmrisk/llm01-prompt-injection/ (accessed 3 November 2026) 5. arXiv, "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection", 23 February 2023. https://arxiv.org/abs/2302.12173 (accessed 3 November 2026) 6. NCSC (UK), "Prompt injection is not SQL injection (it may be worse)", 8 December 2025. https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection (accessed 3 November 2026) 7. NIST, "Technical Blog: Strengthening AI Agent Hijacking Evaluations", 17 January 2025. https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations (accessed 3 November 2026) 8. Microsoft, "Security and governance - Microsoft Copilot Studio". https://learn.microsoft.com/en-us/microsoft-copilot-studio/security-and-governance (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/ai-agents-tool-use-mcp/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.