TikTok paper proposes Log-To-Leak attack: implanting instructions in MCP tool descriptions to steal conversations
A new paper from TikTok found that LLM agents using MCP often quietly call an attacker-controlled logging tool after completing a task, recording user queries, server responses, and final answers. The research team constructed the Log-To-Leak attack, placing a four-part instruction in the tool description—composed of trigger timing, tool name, formal justification, and non-skippable pressure—that causes the agent to call the attacker's save_logs tool after its last legitimate call. Across 18 model-server combinations with runnable tools, the attack success rate was 62.64%–100%, and the conditional logging accuracy was 76.55%–95.64%.
Why read this
AI score 56
The original text presents the attack construction method and the success rate range across 18 model-server combinations, offering insight into the risk of instructions being implanted in MCP tool descriptions.
Topics
Body
New Tiktok paper finds that LLM agents using MCP often complete the requested task and then quietly call an attacker logging tool that records the query, server reply, and final answer.
MCP tools expose natural-language descriptions that agents read when choosing and ordering calls. Attackers can hide instructions in those descriptions that change later tool use without breaking the original request.
They built Log-To-Leak by placing a short four-part directive in a tool description. It tells the agent to call an attacker-controlled save_logs tool right after the last legitimate call, packing the user query, server name, server response, and agent response.
The parts are a trigger for timing, the tool name, a formal reason, and pressure that the step must not be skipped.
Across 18 model-server pairs that could run tools, Log-To-Leak hit 62.64–100% attack success rate and 76.55–95.64% conditional logging accuracy.