Log-To-Leak: A prompt injection attack against LLM agents that use tools via MCP
Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
Quick read
Based on the paper's full text (AI-generated); refer to the original
The paper proposes Log-To-Leak, a prompt injection attack against LLM agents that use tools via MCP. It plants instructions in an attacker-controlled tool description, inducing the agent to append an attacker-controlled logging call after the last legitimate call, exfiltrating the user query, MCP server name, server response and agent response. In evaluations across 5 MCP servers and GPT-4o, GPT-5, Claude-Sonnet-4 and GPT-OSS-120B, the attack success rate was 62.64%–100% for 18 model-server combinations that could execute tool calls normally, conditional logging accuracy was 76.55%–95.64%, and the change in task completion rate for 16 combinations did not exceed 6.63 percentage points. The authors argue that MCP tool metadata should be treated as untrusted input, with the host separately authorizing and auditing secondary tool calls.
- LLM agents access external tools through MCP, and the natural-language metadata describing tools constitutes a prompt-injection surface. Existing tool-poisoning research mostly focuses on malicious tool selection or data exfiltration, but lacks a characterization of the execution property of “appending an unauthorized logging call after the last legitimate call,” and normal task completion does not indicate that no leakage occurred.
- The authors propose Log-To-Leak, which splits the injected instruction into four components—Trigger, Tool Binding, Justification, and Pressure—and writes them into an attacker-controlled tool description to induce the agent to call save_logs after the final legitimate call, recording the user query, MCP server name, server response, and agent response. The experiments cover 5 MCP servers and 4 LLM agents, using ASR, conditional LA, ΔTCR, ΔMCR, and ΔTU to measure effectiveness, task preservation, and overhead, respectively, and test four types of defenses.
- On 18 model–server combinations that could effectively execute tools, ASR was 62.64–100% and conditional LA was 76.55–95.64%; for 16 combinations, the absolute change in target task completion rate did not exceed 6.63 percentage points, with GPT-5 showing larger decreases on GitHub and Mapbox. The four-component template achieved the highest ASR in the ablation; on GitHub MCP with GPT-4o, residual ASR after three defenses remained above 55%, and the instruction detector misclassified 85.53% of benign descriptions as injection.
- The attack depends on the user or integrator enabling an attacker-controlled MCP server and exposing its metadata; differences in MCP implementations, model versions, and permission models may make the results difficult to transfer directly. The evaluation covers only 4 models, 5 servers, and 555 tasks; the main controlled testbed is GitHub MCP, and only one configuration each is tested for deployed clients; LA uses exact matching and fixed-threshold similarity, which cannot cover all semantic leakage; the ablation uses only 3 generated prompts per configuration; the defense study covers only some methods and does not actually test host-side authorization controls.
The paper quantifies post-hoc log leakage from MCP tool poisoning, showing that tasks can complete normally while still carrying data exfiltration, and that secondary tool calls require separate authorization.