Threat
Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol
Publication date unknown · Discovered arxiv.org
Page published
Publication date unknown · First observed: 30 Oct 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Log-To-Leak demonstrates that successful task completion can conceal unauthorized data disclosure, highlighting the need for host-enforced authorization of secondary tool calls rather than reliance on model instructions alone.
Log-To-Leak is a demonstrated prompt-injection attack through MCP tool metadata that induces an unauthorized attacker-controlled logging call after legitimate task completion, exposing user queries and server and agent responses. Researchers report 62.64–100% attack success across 18 model–server pairs with valid tool execution; three evaluated defenses still left attack success above 55% on GitHub MCP with GPT-4o.