Hidden instructions in tool descriptions make agents leak their conversations
A paper shows that instructions hidden in Model Context Protocol tool descriptions can make agents finish a task and then send the conversation to an attacker’s logging tool, succeeding in 62.64–100% of tested cases.
Source published · In the Daily Brief of 29 October 2026
Agents built on large language models reach external tools through the Model Context Protocol (MCP), which describes each tool in natural language. Hu et al. study an attack they call Log-To-Leak, in which a poisoned description tells the agent to make one extra call after its last legitimate one, to a logging tool controlled by the attacker. The payload carries the user’s query, the server’s name and response, and the agent’s answer.
Across 18 pairs of models and MCP servers with valid tool execution, the attack succeeded 62.64–100% of the time and logged the targeted content accurately in 76.55–95.64% of successful cases. In 16 of the pairs, completion of the user’s real task changed by at most 6.63 percentage points, so the leak is hard to notice from the output.
Three defences the authors tested left success rates above 55% on the GitHub server with GPT-4o, and an instruction detector flagged 85.53% of benign descriptions. The authors argue that secondary tool calls should require authorisation by the host application.