Evidence · DiggingBeagle record
Log-To-Leak: Prompt Injection Through MCP Tool Descriptions
Log-To-Leak study across five MCP servers and four agents, measuring extra logging-call success, payload fidelity and original task completion. The leakage channel is a tool call induced by poisoned metadata, not an observed customer campaign.
- Source role
- primary disclosure
Evidence record
Log-To-Leak study across five MCP servers and four agents, measuring extra logging-call success, payload fidelity and original task completion. The leakage channel is a tool call induced by poisoned metadata, not an observed customer campaign.
Claim-level citations (3)
- supportsPoisoned MCP descriptions added an unrequested telemetry call after a valid task: Across 18 model-server pairs with valid execution, the study reports attack success ranging from 62.64% to 100% in its selected harness.
Abstract; 18 valid agent-server pairs
- supportsPoisoned MCP descriptions added an unrequested telemetry call after a valid task: Conditional logging accuracy ranges from 76.55% to 95.64% under the test definitions; many original legitimate tasks still complete.
Abstract; payload fidelity and task-completion results
- supportsPoisoned MCP descriptions added an unrequested telemetry call after a valid task: The study reports that three evaluated defenses left residual attack success above 55% on a GitHub MCP test with GPT-4o, while one instruction detector flagged 85.53% of benign descriptions.
Abstract, defense evaluation