{"id":1712,"date":"2026-07-01T07:22:20","date_gmt":"2026-07-01T00:22:20","guid":{"rendered":"https:\/\/vncybers.vn\/mcp-tool-poisoning-bai-hoc-bao-mat-ai-agent\/"},"modified":"2026-07-01T07:22:20","modified_gmt":"2026-07-01T00:22:20","slug":"mcp-tool-poisoning-bai-hoc-bao-mat-ai-agent","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/mcp-tool-poisoning-bai-hoc-bao-mat-ai-agent\/","title":{"rendered":"MCP tool poisoning: B\u00e0i h\u1ecdc b\u1ea3o m\u1eadt khi AI agent chuy\u1ec3n t\u1eeb \u0111\u1ecdc sang h\u00e0nh \u0111\u1ed9ng"},"content":{"rendered":"

Microsoft Incident Response c\u1ea3nh b\u00e1o r\u1eb1ng c\u00e1c h\u1ec7 th\u1ed1ng AI agent<\/strong> trong doanh nghi\u1ec7p \u0111ang b\u01b0\u1edbc v\u00e0o giai \u0111o\u1ea1n r\u1ee7i ro m\u1edbi: kh\u00f4ng ch\u1ec9 \u0111\u1ecdc v\u00e0 t\u00f3m t\u1eaft d\u1eef li\u1ec7u, m\u00e0 c\u00f2n c\u00f3 th\u1ec3 g\u1ecdi c\u00f4ng c\u1ee5, truy v\u1ea5n h\u1ec7 th\u1ed1ng nghi\u1ec7p v\u1ee5 v\u00e0 th\u1ef1c hi\u1ec7n h\u00e0nh \u0111\u1ed9ng thay ng\u01b0\u1eddi d\u00f9ng. Khi ranh gi\u1edbi n\u00e0y thay \u0111\u1ed5i, m\u1ed9t m\u00f4 t\u1ea3 c\u00f4ng c\u1ee5 b\u1ecb \u0111\u1ea7u \u0111\u1ed9c trong Model Context Protocol<\/strong> (MCP) c\u00f3 th\u1ec3 bi\u1ebfn quy tr\u00ecnh h\u1ee3p l\u1ec7 th\u00e0nh k\u00eanh r\u00f2 r\u1ec9 d\u1eef li\u1ec7u.<\/p>\n

V\u1ea5n \u0111\u1ec1 \u0111\u01b0\u1ee3c Microsoft g\u1ecdi l\u00e0 MCP tool poisoning<\/strong>. Thay v\u00ec khai th\u00e1c tr\u1ef1c ti\u1ebfp l\u1ed7 h\u1ed5ng trong m\u00f4 h\u00ecnh hay n\u1ec1n t\u1ea3ng Copilot, k\u1ebb t\u1ea5n c\u00f4ng ch\u1ec9nh s\u1eeda ph\u1ea7n m\u00f4 t\u1ea3 t\u1ef1 nhi\u00ean c\u1ee7a m\u1ed9t c\u00f4ng c\u1ee5 MCP \u0111\u00e3 \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t. Agent \u0111\u1ecdc m\u00f4 t\u1ea3 \u0111\u00f3 \u0111\u1ec3 quy\u1ebft \u0111\u1ecbnh khi n\u00e0o v\u00e0 c\u00e1ch n\u00e0o g\u1ecdi c\u00f4ng c\u1ee5, v\u00ec v\u1eady m\u1ed9t \u0111o\u1ea1n h\u01b0\u1edbng d\u1eabn \u0111\u1ed9c h\u1ea1i c\u00f3 th\u1ec3 \u0111i\u1ec1u h\u01b0\u1edbng h\u00e0nh vi c\u1ee7a agent m\u00e0 ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng nh\u00ecn th\u1ea5y.<\/p>\n

\"Minh<\/p>\n

\u0110i\u1ec3m m\u1edbi c\u1ee7a r\u1ee7i ro MCP tool poisoning<\/h2>\n

Trong c\u00e1c k\u1ecbch b\u1ea3n prompt injection truy\u1ec1n th\u1ed1ng, t\u00e1c \u0111\u1ed9ng th\u01b0\u1eddng d\u1eebng \u1edf vi\u1ec7c l\u00e0m sai l\u1ec7ch c\u00e2u tr\u1ea3 l\u1eddi ho\u1eb7c khi\u1ebfn h\u1ec7 th\u1ed1ng t\u00f3m t\u1eaft n\u1ed9i dung theo h\u01b0\u1edbng kh\u00f4ng mong mu\u1ed1n. V\u1edbi AI agent c\u00f3 quy\u1ec1n h\u00e0nh \u0111\u1ed9ng, t\u00e1c \u0111\u1ed9ng c\u00f3 th\u1ec3 \u0111i xa h\u01a1n: truy v\u1ea5n d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m, g\u1eedi tham s\u1ed1 ra c\u00f4ng c\u1ee5 b\u00ean ngo\u00e0i, t\u1ea1o t\u00e0i li\u1ec7u, g\u1eedi email ho\u1eb7c thay \u0111\u1ed5i l\u1ecbch l\u00e0m vi\u1ec7c.<\/p>\n

Microsoft m\u00f4 t\u1ea3 m\u1ed9t v\u00ed d\u1ee5 trong quy tr\u00ecnh t\u00e0i ch\u00ednh. M\u1ed9t nh\u00f3m v\u1eadn h\u00e0nh d\u00f9ng agent \u0111\u1ec3 x\u1eed l\u00fd h\u00f3a \u0111\u01a1n nh\u00e0 cung c\u1ea5p. Agent k\u1ebft n\u1ed1i v\u1edbi d\u1eef li\u1ec7u nh\u00e0 cung c\u1ea5p n\u1ed9i b\u1ed9, email v\u00e0 m\u1ed9t m\u00e1y ch\u1ee7 MCP b\u00ean th\u1ee9 ba d\u00f9ng \u0111\u1ec3 l\u00e0m gi\u00e0u th\u00f4ng tin h\u00f3a \u0111\u01a1n. N\u1ebfu m\u00e1y ch\u1ee7 b\u00ean th\u1ee9 ba c\u1eadp nh\u1eadt m\u00f4 t\u1ea3 c\u00f4ng c\u1ee5 theo h\u01b0\u1edbng \u0111\u1ed9c h\u1ea1i, agent c\u00f3 th\u1ec3 b\u1ecb y\u00eau c\u1ea7u \u00e2m th\u1ea7m l\u1ea5y danh s\u00e1ch h\u00f3a \u0111\u01a1n ch\u01b0a thanh to\u00e1n, t\u00f3m t\u1eaft d\u1eef li\u1ec7u \u0111\u00f3 v\u00e0 \u0111\u00ednh k\u00e8m v\u00e0o l\u1ec7nh g\u1ecdi c\u00f4ng c\u1ee5 d\u01b0\u1edbi v\u1ecf b\u1ecdc ki\u1ec3m tra gian l\u1eadn.<\/p>\n

V\u00ec sao h\u00e0nh vi n\u00e0y kh\u00f3 ph\u00e1t hi\u1ec7n?<\/h2>\n

\u0110i\u1ec3m nguy hi\u1ec3m n\u1eb1m \u1edf ch\u1ed7 t\u1eebng h\u00e0nh \u0111\u1ed9ng ri\u00eang l\u1ebb \u0111\u1ec1u c\u00f3 v\u1ebb h\u1ee3p l\u1ec7. C\u00f4ng c\u1ee5 \u0111\u00e3 \u0111\u01b0\u1ee3c cho ph\u00e9p, truy v\u1ea5n d\u1eef li\u1ec7u k\u1ebf th\u1eeba quy\u1ec1n c\u1ee7a ng\u01b0\u1eddi d\u00f9ng, c\u00f2n k\u1ebft n\u1ed1i outbound \u0111i t\u1edbi m\u00e1y ch\u1ee7 \u0111\u00e3 n\u1eb1m trong danh s\u00e1ch \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t. N\u1ebfu h\u1ec7 th\u1ed1ng ch\u1ec9 ki\u1ec3m tra quy\u1ec1n truy c\u1eadp t\u0129nh, chu\u1ed7i h\u00e0nh vi c\u00f3 th\u1ec3 kh\u00f4ng t\u1ea1o c\u1ea3nh b\u00e1o r\u00f5 r\u00e0ng.<\/p>\n

The Hacker News t\u00f3m l\u01b0\u1ee3c v\u1ea5n \u0111\u1ec1 n\u00e0y l\u00e0 t\u00ecnh hu\u1ed1ng agent kh\u00f4ng nh\u1ea5t thi\u1ebft ph\u00e1 v\u1ee1 quy t\u1eafc, nh\u01b0ng v\u1eabn l\u00e0m l\u1ed9 d\u1eef li\u1ec7u v\u00ec quy t\u1eafc v\u1eadn h\u00e0nh \u0111\u00e3 b\u1ecb t\u00e1c \u0111\u1ed9ng t\u1eeb metadata c\u1ee7a c\u00f4ng c\u1ee5. N\u00f3i c\u00e1ch kh\u00e1c, m\u00f4 t\u1ea3 c\u00f4ng c\u1ee5 kh\u00f4ng c\u00f2n l\u00e0 t\u00e0i li\u1ec7u v\u00f4 h\u1ea1i; trong b\u1ed1i c\u1ea3nh agentic AI, n\u00f3 c\u00f3 th\u1ec3 ho\u1ea1t \u0111\u1ed9ng g\u1ea7n gi\u1ed1ng m\u1ed9t ph\u1ea7n c\u1ee7a system prompt.<\/p>\n

B\u00e0i h\u1ecdc cho doanh nghi\u1ec7p tri\u1ec3n khai AI agent<\/h2>\n

B\u00e0i h\u1ecdc \u0111\u1ea7u ti\u00ean l\u00e0 xem m\u1ecdi m\u00e1y ch\u1ee7 MCP v\u00e0 m\u1ecdi connector c\u00f3 quy\u1ec1n h\u00e0nh \u0111\u1ed9ng nh\u01b0 m\u1ed9t th\u00e0nh ph\u1ea7n c\u1ee7a chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m. Doanh nghi\u1ec7p c\u1ea7n ki\u1ec3m k\u00ea ngu\u1ed3n ph\u00e1t h\u00e0nh, ch\u1ee7 s\u1edf h\u1eefu, ph\u1ea1m vi d\u1eef li\u1ec7u, quy\u1ec1n h\u00e0nh \u0111\u1ed9ng v\u00e0 l\u1ecbch s\u1eed thay \u0111\u1ed5i metadata c\u1ee7a t\u1eebng c\u00f4ng c\u1ee5 tr\u01b0\u1edbc khi \u0111\u01b0a v\u00e0o m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t.<\/p>\n

B\u00e0i h\u1ecdc th\u1ee9 hai l\u00e0 \u00e1p d\u1ee5ng nguy\u00ean t\u1eafc least agency<\/strong>, kh\u00f4ng ch\u1ec9 least privilege<\/strong>. M\u1ed9t agent c\u00f3 \u00edt quy\u1ec1n v\u1eabn c\u00f3 th\u1ec3 g\u00e2y h\u1ea1i n\u1ebfu \u0111\u01b0\u1ee3c t\u1ef1 \u0111\u1ed9ng g\u1ecdi qu\u00e1 nhi\u1ec1u c\u00f4ng c\u1ee5, g\u1eedi tham s\u1ed1 ra ngo\u00e0i ho\u1eb7c th\u1ef1c hi\u1ec7n h\u00e0nh \u0111\u1ed9ng nh\u1ea1y c\u1ea3m m\u00e0 kh\u00f4ng c\u1ea7n x\u00e1c nh\u1eadn c\u1ee7a con ng\u01b0\u1eddi. V\u1edbi d\u1eef li\u1ec7u t\u00e0i ch\u00ednh, d\u1eef li\u1ec7u kh\u00e1ch h\u00e0ng ho\u1eb7c thay \u0111\u1ed5i t\u00e0i kho\u1ea3n, c\u01a1 ch\u1ebf ph\u00ea duy\u1ec7t th\u1ee7 c\u00f4ng v\u1eabn l\u00e0 l\u1edbp ki\u1ec3m so\u00e1t c\u1ea7n thi\u1ebft.<\/p>\n

Khuy\u1ebfn ngh\u1ecb ki\u1ec3m so\u00e1t th\u1ef1c t\u1ebf<\/h2>\n

Microsoft khuy\u1ebfn ngh\u1ecb duy tr\u00ec danh s\u00e1ch cho ph\u00e9p \u1edf c\u1ea5p tenant \u0111\u1ed1i v\u1edbi publisher v\u00e0 MCP server, t\u1eaft c\u01a1 ch\u1ebf cho ph\u00e9p t\u1ea5t c\u1ea3 c\u00f4ng c\u1ee5, \u0111\u1ed3ng th\u1eddi ch\u1ec9 b\u1eadt nh\u1eefng c\u00f4ng c\u1ee5 agent th\u1eadt s\u1ef1 c\u1ea7n. M\u1ecdi thay \u0111\u1ed5i m\u00f4 t\u1ea3 c\u00f4ng c\u1ee5 trong m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t n\u00ean \u0111\u01b0\u1ee3c r\u00e0 so\u00e1t nh\u01b0 thay \u0111\u1ed5i system prompt, nh\u1ea5t l\u00e0 khi metadata ch\u1ee9a c\u00e2u l\u1ec7nh mang t\u00ednh b\u1eaft bu\u1ed9c, y\u00eau c\u1ea7u thu th\u1eadp d\u1eef li\u1ec7u ho\u1eb7c m\u1edf r\u1ed9ng ph\u1ea1m vi tham s\u1ed1.<\/p>\n

C\u00e1c t\u1ed5 ch\u1ee9c c\u0169ng n\u00ean gi\u00e1m s\u00e1t tham s\u1ed1 c\u1ee7a l\u1ec7nh g\u1ecdi c\u00f4ng c\u1ee5 b\u1eb1ng DLP, d\u00f9ng c\u01a1 ch\u1ebf b\u1ea3o v\u1ec7 prompt \u0111\u1ec3 ki\u1ec3m tra n\u1ed9i dung \u0111i v\u00e0o ng\u1eef c\u1ea3nh agent, \u0111\u1ed3ng th\u1eddi \u0111\u01b0a telemetry t\u1eeb MCP server, agent runtime v\u00e0 h\u1ec7 th\u1ed1ng SIEM v\u00e0o c\u00f9ng m\u1ed9t chu\u1ed7i ph\u00e2n t\u00edch. Nh\u1eefng t\u00edn hi\u1ec7u nh\u01b0 agent \u0111\u1ed9t ng\u1ed9t g\u1ecdi endpoint m\u1edbi, g\u1eedi payload l\u1edbn b\u1ea5t th\u01b0\u1eddng ho\u1eb7c truy v\u1ea5n d\u1eef li\u1ec7u ngo\u00e0i ph\u1ea1m vi y\u00eau c\u1ea7u ban \u0111\u1ea7u c\u1ea7n \u0111\u01b0\u1ee3c xem l\u00e0 d\u1ea5u hi\u1ec7u \u0111i\u1ec1u tra.<\/p>\n

Conclusion<\/h2>\n

MCP tool poisoning cho th\u1ea5y b\u1ea3o m\u1eadt AI agent kh\u00f4ng th\u1ec3 ch\u1ec9 d\u1ef1a v\u00e0o ki\u1ec3m so\u00e1t m\u00f4 h\u00ecnh. Khi agent \u0111\u01b0\u1ee3c ph\u00e9p h\u00e0nh \u0111\u1ed9ng, metadata c\u1ee7a c\u00f4ng c\u1ee5, connector b\u00ean th\u1ee9 ba v\u00e0 quy tr\u00ecnh ph\u00ea duy\u1ec7t thay \u0111\u1ed5i tr\u1edf th\u00e0nh m\u1ed9t ph\u1ea7n tr\u1ef1c ti\u1ebfp c\u1ee7a b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng. Doanh nghi\u1ec7p c\u1ea7n qu\u1ea3n tr\u1ecb agent nh\u01b0 qu\u1ea3n tr\u1ecb m\u1ed9t h\u1ec7 th\u1ed1ng s\u1ea3n xu\u1ea5t c\u00f3 quy\u1ec1n truy c\u1eadp d\u1eef li\u1ec7u th\u1eadt, h\u00e0nh \u0111\u1ed9ng th\u1eadt v\u00e0 r\u1ee7i ro v\u1eadn h\u00e0nh th\u1eadt.<\/p>\n

VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb Microsoft Security Blog v\u00e0 The Hacker News<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Microsoft Incident Response c\u1ea3nh b\u00e1o r\u1eb1ng c\u00e1c h\u1ec7 th\u1ed1ng AI agent trong doanh nghi\u1ec7p \u0111ang b\u01b0\u1edbc v\u00e0o giai \u0111o\u1ea1n r\u1ee7i ro m\u1edbi: kh\u00f4ng ch\u1ec9 \u0111\u1ecdc v\u00e0 t\u00f3m t\u1eaft d\u1eef li\u1ec7u, m\u00e0 c\u00f2n c\u00f3 th\u1ec3 g\u1ecdi c\u00f4ng c\u1ee5, truy v\u1ea5n h\u1ec7 th\u1ed1ng nghi\u1ec7p v\u1ee5 v\u00e0 th\u1ef1c hi\u1ec7n h\u00e0nh \u0111\u1ed9ng thay ng\u01b0\u1eddi d\u00f9ng. Khi ranh gi\u1edbi n\u00e0y […]<\/p>\n","protected":false},"author":2,"featured_media":1710,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[308,101,310,100,309,313,311,314,312,315,153,307],"class_list":["post-1712","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kien-thuc","tag-ai-agent","tag-chuoi-cung-ung-ai","tag-copilot-studio","tag-mcp","tag-microsoft-incident-response","tag-microsoft-purview-dlp","tag-model-context-protocol","tag-owasp-agentic-applications","tag-prompt-shields","tag-ro-ri-du-lieu","tag-the-hacker-news","tag-tool-poisoning"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=1712"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/1712\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/1710"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=1712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=1712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=1712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}