How Much Can Tool Calls Reveal About You? Privacy Leakage from Tool-Call Traces

Summary

Researchers study whether observers can infer user attributes from MCP tool-call traces alone, without access to user conversations. They introduce PrivacyTrace, a benchmark of 1,000 synthetic user profiles and 4,000 agent trajectories across four domains, built with real MCP tools from 25 servers. Four LLM attackers reach a 26.25% attack success rate for profile inference, compared with 17.97% from prior-based guessing, with tool arguments and returned results as the main evidence and cross-session trace linking amplifying the risk.

Topics

• Model Context Protocol

Related items

• MediumHundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake FeaturesSimilar attack · Wired (Security)
• MediumNew VOLTA Infostealer Uses Claude, Gemini, and Kimi AI to Rank Victims by Financial ValueSimilar attack · The Hacker News
• MediumHow We Took Over ChatGPT AccountsSimilar attack · Simon Willison's Weblog
• Medium“Black October” for AI Developer PlatformsSimilar attack · Wiz Research Blog
• MediumCVE-2026-118760: Kubeflow Pipelines artifact routes allow cross-namespace artifact readsSimilar attack · NVD/CVE Database