TikTok 论文提出 Log-To-Leak 攻击：在 MCP 工具描述中植入指令窃取对话
New Tiktok paper finds that LLM agents using MCP often complete the requested task and then quietly call an attacker logging tool that records the query, server
TikTok 的一篇新论文发现，使用 MCP 的 LLM 智能体常在完成任务后悄悄调用攻击者控制的日志工具，记录用户查询、服务器回复和最终答案。研究团队构造了 Log-To-Leak 攻击，在工具描述中放入由触发时机、工具名、正式理由和不可跳过压力组成的四段式指令，让智能体在最后一次合法调用后调用攻击者的 save_logs 工具。在 18 组可运行工具的模型-服务器组合中，攻击成功率为 62.64%–100%，条件日志准确率为 76.55%–95.64%。
正文
New Tiktok paper finds that LLM agents using MCP often complete the requested task and then quietly call an attacker logging tool that records the query, server reply, and final answer.
MCP tools expose natural-language descriptions that agents read when choosing and ordering calls. Attackers can hide instructions in those descriptions that change later tool use without breaking the original request.
They built Log-To-Leak by placing a short four-part directive in a tool description. It tells the agent to call an attacker-controlled save_logs tool right after the last legitimate call, packing the user query, server name, server response, and agent response.
The parts are a trigger for timing, the tool name, a formal reason, and pressure that the step must not be skipped.
Across 18 model-server pairs that could run tools, Log-To-Leak hit 62.64–100% attack success rate and 76.55–95.64% conditional logging accuracy.