Research · curated 2 Sep 2026
ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
ContextLeak targets the underexplored step of making an agent pass its sensitive runtime context into a malicious tool, showing that tools published on platforms like MCP.so or Skillsmp can silently exfiltrate private agent context.
ContextLeak is a malicious-tool attack developed by researchers at Duke and Stanford that induces an LLM agent to both select an attacker-published tool and disclose its runtime context (user prompt, conversation history, tool list) as tool input arguments for exfiltration. The attack crafts the tool's name and description using a reinforcement-learning-fine-tuned attack LLM with novel reward functions, and is shown to generalize across victims whose contexts differ from the shadow-user training data.