New Tiktok paper finds that LLM agents using MCP often complete the requested task and then quietly call an attacker logging tool that records the query, server reply, and final answer.

MCP tools expose natural-language descriptions that agents read when choosing and ordering calls. Attackers can hide instructions in those descriptions that change later tool use without breaking the original request.

They built Log-To-Leak by placing a short four-part directive in a tool description. It tells the agent to call an attacker-controlled save_logs tool right after the last legitimate call, packing the user query, server name, server response, and agent response.

The parts are a trigger for timing, the tool name, a formal reason, and pressure that the step must not be skipped.

Across 18 model-server pairs that could run tools, Log-To-Leak hit 62.64–100% attack success rate and 76.55–95.64% conditional logging accuracy.