Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol

Summary

This research paper studies Log-To-Leak, an additive post-hoc logging attack in which injected MCP tool-description metadata induces a separate attacker-controlled call after the final legitimate call, leaking the user query, MCP server name, server response, and agent response. Across five MCP servers and four LLM agents, the attack achieved an attack success rate of 62.64-100% and conditional logging accuracy of 76.55-95.64% on 18 valid model-server pairs, while legitimate task completion changed by at most 6.63 percentage points in 16 pairs. Three evaluated defenses left residual ASR above 55% on GitHub MCP with GPT-4o, and an instruction detector flagged 85.53% of benign descriptions.

Mitigation

The paper motivates host-controlled authorization for secondary tool calls.

Topics

• Model Context Protocol
• Prompt injection and jailbreaks

Related items

• InfoChart: Anthropic's cash pile towers over nearly every U.S. companySame vendor · CNBC Technology
• InfoOpenAI's GPT-6.1 Terra is safer overall, but shows more destructive-action flags in testsSame vendor · BleepingComputer
• LowBank of America kindly asks that you don’t share your banking password with your AI assistantSame vendor · TechCrunch (Security)
• InfoWalmart says AI training is boosting confidence with the technology among its 2.1 million associatesSame vendor · CNBC Technology
• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database