The setup

A support agent used a third-party MCP server to look up accounts. The server was reputable, its code was reviewed, and its permissions looked reasonable on paper.

The chain

An update changed one tool’s description. Models read descriptions as instructions, so the new text told the agent to pass the full conversation to the lookup call. Nothing in the code path changed, so nothing in the review flagged it.

Why scanners missed it

Static analysis looks at code. This payload lived in metadata, and it only became an attack once a model read it.

The fix

Pin tool descriptions by hash, alert when they change, and bind tenant context to the session instead of letting the model supply it.