Skip to content
NewA calmer, faster ZeroHour
AI safety & securitymedium

Log-To-Leak prompt injection extracts MCP agent data after real calls

Original title: Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol

arXiv cs.CRby Yuepeng Hu ()1 min read1
Read at arxiv.org
Part of a story covered by 2 sourcesResearchers report Log-To-Leak prompt injection on MCP agentsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Across 18 model-server pairs, attack success is 62.64–100%, and defenses still exceed 55% ASR on GitHub MCP with GPT-4o.

Researchers describe Log-To-Leak, a post-hoc prompt-injection attack on tool-using LLM agents that use the Model Context Protocol. Poisoned natural-language tool metadata induces an extra attacker-controlled call after the last legitimate call, targeting the user query, MCP server name, server response, and agent response. On 18 model-server pairs with valid tool execution, they report attack success of 62.64–100% and conditional logging accuracy of 76.55–95.64%, while 16 pairs change target-task completion by at most 6.63 percentage points. Three defenses still leave residual success above 55% on GitHub MCP with GPT-4o, and an instruction detector flags 85.53% of benign descriptions.

Unconfirmed: Success rates are from the authors' lab evaluation, not reported real-world incidents.

Key facts
  • The payload is built from Trigger, Tool Binding, Justification, and Pressure.
  • Five MCP servers and four LLM agents were evaluated with five metrics.
  • Sixteen pairs shift legitimate task completion by at most 6.63 percentage points.
  • An instruction detector flags 85.53% of benign tool descriptions.
  • Authors argue hosts should authorize secondary tool calls.
Security assessment · AI, from the articlePublic proof of concept

Impact: Unauthorized disclosure of queries and agent and tool responses

ProductAffected
Model Context Protocol tool-using LLM agents—
What to do
  1. 1.Require host-controlled authorization before secondary tool calls.
  2. 2.Review MCP tool descriptions for injected logging directives.
Explain this AI news with Vani AIWhat was announced, what is new and why it matters, in a new chat
Tags
prompt-injectionmcpllm-agentstool-poisoninggpt-4o
Products
Model Context ProtocolGitHub MCP
Malware
Log-To-Leak
AI models
GPT-4o

From the original article

1 min read at arxiv.org

LLM agents increasingly access external tools through the Model Context Protocol (MCP), but the natural-language metadata used to describe those tools creates a prompt-injection surface. Within this established tool-poisoning surface, we study Log-To-Leak, an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call.

arXiv cs.CR

By Yuepeng Hu · arxiv.org

Read the full article at arXiv cs.CR

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.