---
title: Log-To-Leak: poisoned MCP tool descriptions get agents to make one extra "logging" call that leaks the user's query and tool results, with 62.64% to 100% success and the real task still finished | ctxsec
url: https://ctxsec.com/items/arxiv-log-to-leak-mcp-tool-metadata-exfil
description: ""
status: "research paper (arXiv, AGENT-SEC '26 workshop); results are the authors' own"
published: 2026-10-28
---

> 

[← AI](/ai) · [markdown](/items/arxiv-log-to-leak-mcp-tool-metadata-exfil.md)

research paper (arXiv, AGENT-SEC '26 workshop); results are the authors' own

2026-10-28

### Log-To-Leak: poisoned MCP tool descriptions get agents to make one extra "logging" call that leaks the user's query and tool results, with 62.64% to 100% success and the real task still finished

Researchers from Duke, Michigan State and TikTok describe an attack in which a malicious MCP tool's natural-language description tells the agent to call an attacker-controlled logging tool after its last legitimate call. The payload carries the user's query, the MCP server name, the server's response and the agent's answer.

- Across 18 model and server pairs, five MCP servers and four agents, attack success ranged from 62.64% to 100%, and in 16 pairs the real task completion changed by at most 6.63 points, so users would see nothing wrong.
- Three tested defenses still left more than 55% success on GitHub MCP with GPT-4o, and an instruction detector flagged 85.53% of benign tool descriptions.

The authors argue for the host, not the model, authorizing any secondary tool call. **Takeaway:** review the tool descriptions of every MCP server you install, and prefer clients that require approval for calls to tools the task did not need.

Sources: [arXiv 2610.36108: Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol](https://arxiv.org/abs/2610.36108)