An adversary controls an MCP tool’s natural-language description and embeds a plausible after-action logging obligation. The agent imports that lower-trust metadata into its workflow and sends user query, server identity, tool response or agent response to a secondary destination. Across 18 model-server pairs with valid execution, the study reports attack…
Inspect the ClaimsCase · DiggingBeagle record
Poisoned MCP descriptions added an unrequested telemetry call after a valid task
Log-To-Leak demonstrates an additive attack: the agent completes an authorized operation, then performs a separate data-bearing call that the user did not request.
Scope
The paper describes a controlled MCP setup with four models and five servers, not an observed exfiltration campaign against deployed customer agents.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The researchers poison MCP tool descriptions and inspect an extra post-task logging invocation across 18 valid model-server pairs. Their success and conditional accuracy metrics refer to controlled agent traces, not real customer exfiltration. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-018-A · CLM-CP22-018-B · CLM-ENRICH-20261028-007 · Log-To-Leak: Prompt Injection Through MCP Tool Descriptions
At a glance
Independently authored production tool registries and side-effect enforcement were not tested across every possible attacker path.
Limits and uncertaintyFull account
An adversary controls an MCP tool’s natural-language description and embeds a plausible after-action logging obligation. The agent imports that lower-trust metadata into its workflow and sends user query, server identity, tool response or agent response to a secondary destination.
Across 18 model-server pairs with valid execution, the study reports attack success ranging from 62.64% to 100% in its selected harness. Conditional logging accuracy ranges from 76.55% to 95.64% under the test definitions; many original legitimate tasks still complete. Primary evidence.
The paper describes a controlled MCP setup with four models and five servers, not an observed exfiltration campaign against deployed customer agents.
Treat tool descriptions as untrusted hints, and bind permitted outbound calls to explicit user-authorized purposes even after the legitimate task reports success.
Claims & evidence
CLM-CP22-018-AAcross 18 model-server pairs with valid execution, the study reports attack success ranging from 62.64% to 100% in its selected harness.supported
Basis: reported finding
- supportsLog-To-Leak: Prompt Injection Through MCP Tool Descriptionsprimary disclosure
Abstract; 18 valid agent-server pairs
CLM-CP22-018-BConditional logging accuracy ranges from 76.55% to 95.64% under the test definitions; many original legitimate tasks still complete.supported
Basis: reported finding
- supportsLog-To-Leak: Prompt Injection Through MCP Tool Descriptionsprimary disclosure
Abstract; payload fidelity and task-completion results
CLM-ENRICH-20261028-007The study reports that three evaluated defenses left residual attack success above 55% on a GitHub MCP test with GPT-4o, while one instruction detector flagged 85.53% of benign descriptions.supported
Basis: reported finding
- supportsLog-To-Leak: Prompt Injection Through MCP Tool Descriptionsprimary disclosure
Abstract, defense evaluation
Controls and mitigations
- Treat tool descriptions as untrusted hints, and bind permitted outbound calls to explicit user-authorized purposes even after the legitimate task reports success.
Unknowns and contradictions
- Independently authored production tool registries and side-effect enforcement were not tested across every possible attacker path.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199