The attack adds a false call for "dualization" after the legitimate task, which normally runs: the user sees nothing, and three defenses tested pass more than 55% of attempts.
AI agents that access tools through the Model Context Protocol (MCP) read the descriptions of those tools in natural language, making them a vector for injection of instructions. Researchers describe Log-To-Leak, a variant that does not disrupt the requested task: it simply causes the agent to call, once its work is complete, an attacker-controlled "logging" tool, to which it forwards the user's request, the name of the MCP server, the response of that server, and its own response.
Tested on five MCP servers and four agents, for 18 actionable combinations, the attack was successful 62.6% to 100% of the time, and the leak faithfully replicated the data 76.6% to 95.6% of the time. In 16 combinations, the completion rate of the legitimate task moved by only 6.6 points at most, making the intrusion difficult to notice.
Insufficient defences
On GitHub's MCP server with GPT-4o, three evaluated defenses leave a success rate of more than 55%, while a suspicious instruction detector incorrectly flags 85.5% of perfectly legitimate descriptions. The authors argue that it should be the host application, not the model, that allows any secondary tool calls.
Read the full article on the original source
Go to the source →