Researchers from Duke, Michigan State and TikTok describe an attack in which a malicious MCP tool's natural-language description tells the agent to call an attacker-controlled logging tool after its last legitimate call. The payload carries the user's query, the MCP server name, the server's response and the agent's answer.

• Across 18 model and server pairs, five MCP servers and four agents, attack success ranged from 62.64% to 100%, and in 16 pairs the real task completion changed by at most 6.63 points, so users would see nothing wrong.
• Three tested defenses still left more than 55% success on GitHub MCP with GPT-4o, and an instruction detector flagged 85.53% of benign tool descriptions.

The authors argue for the host, not the model, authorizing any secondary tool call. Takeaway: review the tool descriptions of every MCP server you install, and prefer clients that require approval for calls to tools the task did not need.