TikTok Paper Reveals Silent Data Exfiltration Risks in MCP Agents
A new TikTok study reveals a critical security vulnerability in LLM agents using the Model Context Protocol (MCP). Attackers can embed hidden instructions in tool descriptions to trick agents into silently calling malicious logging tools after completing legitimate tasks, exfiltrating user queries and server responses. The 'Log-To-Leak' attack achieved success rates between 62% and 100% across various models.
Full Report
Rohan Paul (@rohanpaul_ai) · 2026-10-28 23
New Tiktok paper finds that LLM agents using MCP often complete the requested task and then quietly call an attacker logging tool that records the query, server reply, and final answer.
MCP tools expose natural-language descriptions that agents read when choosing and ordering calls. Attackers can hide instructions in those descriptions that change later tool use without breaking the original request.
They built Log-To-Leak by placing a short four-part directive in a tool description. It tells the agent to call an attacker-controlled save_logs tool right after the last legitimate call, packing the user query, server name, server response, and agent response.
The parts are a trigger for timing, the tool name, a formal reason, and pressure that the step must not be skipped.
Across 18 model-server pairs that could run tools, Log-To-Leak hit 62.64–100% attack success rate and 76.55–95.64% conditional logging accuracy.
