Cyberpediaby Brain
ENDEFR

AI agents, tool use and MCP

An AI agent calls tools on your behalf: mail, files, APIs. What it can get wrong, and how to limit its rights.

In 30 seconds

Where it happens
In any assistant that reads your emails, your documents or web pages and can act (send or delete) without you clicking at each step3.
What the attacker wants
To slip an instruction into content the agent will read, so that it acts on the attacker's behalf, for example by forwarding sensitive emails3.
The reflex
Give the agent the bare minimum of rights, require your approval before any action with an effect (sending, deleting, publishing) and review what it has prepared3.
If it has already happened
Tell your security team, with the date and the tools connected to the agent at that time. Tool activity logs are used to spot abnormal actions3.

What it is

An AI agent is a language model that has been given tools: reading a mailbox, opening files, browsing a website, calling an API. Research papers from 2022 and 2023 describe models trained to decide which APIs to call, when to call them and with which arguments1, or prompted with a few examples to alternate between reasoning and actions and to consult external sources2.

OWASP, which maintains the list of the main risks for applications built on language models, speaks of "agency": the ability to call functions or interact with other systems through extensions, which vendors also call tools, skills or plugins. The choice of which extension to run can be left to the agent itself, which decides based on the request or on the result of a previous call3. For an employee, the question becomes simple: what can this agent do in my name, and who checks before it is done?

Straight answers

What distinguishes an agent from a simple chat assistant?

A chat assistant answers. An agent acts: it makes repeated calls to the model, relying on the result of earlier calls to guide the next ones3. Each tool that is plugged in widens what a mistake or a manipulation can cause.

What is the MCP protocol?

The sources gathered for this entry do not describe MCP. They deal with tools, extensions and connectors in general, and the risks described below apply to any way of connecting an agent to a tool. The protocol itself is therefore not detailed here.

What is an indirect prompt injection?

It is the case where the model receives instructions hidden in external content, such as a website or a file, and changes its behavior because of them4. Researchers showed in 2023 that this route allows remote attacks, without a direct interface, on applications that integrate a model, by placing the instructions in data likely to be retrieved5. The attacker does not need access to the AI: they write something that will end up being read by it6. The text can even be invisible to a human, as long as the model interprets it4.

Can these attacks be blocked with a filter?

Not completely. OWASP considers it unclear whether foolproof prevention exists4. The UK NCSC explains that current models make no distinction between instructions and data: they only predict the next word. It estimates that prompt injection may never be fully fixed, unlike SQL injection, and recommends reducing the risk and the impact6. It also warns against products that claim to "stop" prompt injection6.

What should I review before letting the agent act?

Anything that leaves your perimeter: emails sent or files shared. OWASP gives the example of an email-sending tool where the user reviews and approves each message drafted by the agent3.

1How it works1 min

An application gives the model a set of tools, then lets the model choose which ones to call3. The developer's instructions and the content to process (an email, a page, a file) arrive in a single input. Current agents generally rely on this mix of trusted instructions and untrusted data7.

The NCSC draws a practical consequence from this. When the agent calls tools or APIs based on what the model says, an attacker who manipulates the model gets the equivalent of direct access to those tools, with the worst-case scenario that this implies6.

2What you do2 min

OWASP lists the measures that reduce an agent's excess of power. You do not always control their configuration, but you can request them from the team deploying the tool.

  • Reduce the tools: if the agent does not need to read a web address, it is not given that function3.
  • Reduce the functions: an extension that summarizes emails only needs to read them, not delete them or send any3.
  • Prefer precise tools to open-ended ones, such as "run a command": with the latter, any other command can be launched3.
  • Reduce the permissions: a tool that reads a database must not connect with an identity that can also modify or delete3.
  • Act with your own rights, not with a generic, highly privileged account. For a code repository, OWASP cites an OAuth connection with the minimum scope3.
  • Require human approval for high-impact actions3.
  • Log tool activity to spot abnormal actions, and limit the rate to reduce the number of unwanted actions possible in a given period3.

The NCSC offers a simple rule: when a model processes information coming from a third party, its privileges drop to those of that third party. An agent that reads emails from outside people must therefore not have access to privileged tools6.

On the platform side, Microsoft describes administrator-only controls for Copilot Studio: data policies on connectors, actions and HTTP requests, analysis of connector dependencies before deployment, audit logs, and the option to disable publishing of agents that use generative AI. Agent designers can also configure tools to run with the user's credentials8.

3Pitfalls1 min
  • The agent with excessive rights. OWASP distinguishes three causes: too much functionality, too many permissions, too much autonomy3. An extension tried out during development, then abandoned, can remain accessible to the agent3. A third-party extension chosen to read documents can also be able to modify and delete them3.
  • The instruction hidden in an email. In OWASP's example, a booby-trapped incoming email pushes a mail assistant to search the inbox and forward sensitive information to the attacker3.
  • The image that leaks the conversation. A user asks the AI to summarize a page containing hidden instructions, which make it insert an image pointing to an address: the private conversation leaves that way4.
  • The altered document in a knowledge base. If an attacker alters a document used by a retrieval-augmented application, the AI's answer can become misleading4.
  • The chaining between tools. An injection can come from an earlier call to a compromised extension, or from another compromised agent in a multi-agent system3.
  • The single test that falsely reassures. NIST notes that a model can resist known attacks and yield to attacks designed for it7.
4Real cases1 min

February 2023: a demonstration on Bing Chat and code assistants

Researchers, including Kai Greshake and Sahar Abdelnabi, submitted a paper on 23 February 2023 showing indirect injection attacks against real systems, including the GPT-4-based Bing Chat and code-completion engines. According to them, processing a retrieved prompt can amount to arbitrary code execution and can control whether and how other APIs are called. They note a lack of effective defenses at that time5.

January 2025: NIST's agent hijacking evaluation

On 17 January 2025, NIST's Center for AI Standards and Innovation published its agent hijacking tests on the AgentDojo framework. Attacks designed specifically for the tested model rose from an 11% success rate (the best baseline attack) to 81%7. Across five injection tasks, including sending an authentication code to a third party and running a malicious script, the average success rate was 57% with one attempt, and 80% with 25 attempts per attack7. These were simulated environments, not incidents in a company7.

Fact sheet

Identifier
CP-264
Wing
4. Artificial intelligence
Brain skill
Mastering AI & Agent Security (master_ai)
Brain reflex
air-048
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
8 sources checked on 3 November 2026
Sources8 sources
  1. arXiv, “Toolformer: Language Models Can Teach Themselves to Use Tools”, 9 February 2023. https://arxiv.org/abs/2302.04761 (accessed 3 November 2026)
  2. arXiv, “ReAct: Synergizing Reasoning and Acting in Language Models”, 6 October 2022. https://arxiv.org/abs/2210.03629 (accessed 3 November 2026)
  3. OWASP, “LLM06:2025 Excessive Agency”. https://genai.owasp.org/llmrisk/llm062025-excessive-agency/ (accessed 3 November 2026)
  4. OWASP, “LLM01:2025 Prompt Injection”. https://genai.owasp.org/llmrisk/llm01-prompt-injection/ (accessed 3 November 2026)
  5. arXiv, “Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection”, 23 February 2023. https://arxiv.org/abs/2302.12173 (accessed 3 November 2026)
  6. NCSC (UK), “Prompt injection is not SQL injection (it may be worse)”, 8 December 2025. https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection (accessed 3 November 2026)
  7. NIST, “Technical Blog: Strengthening AI Agent Hijacking Evaluations”, 17 January 2025. https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations (accessed 3 November 2026)
  8. Microsoft, “Security and governance - Microsoft Copilot Studio”. https://learn.microsoft.com/en-us/microsoft-copilot-studio/security-and-governance (accessed 3 November 2026)

Cite this article

Brain, “AI agents, tool use and MCP”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/ai-agents-tool-use-mcp/

BibTeX 
@misc{brain_cp264_en_2026,
  author = {Brain},
  title = {AI agents, tool use and MCP},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/ai-agents-tool-use-mcp/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence