# Log-To-Leak study shows MCP agents can leak data after completing tasks

> Original title: New Tiktok paper finds that LLM agents using MCP often complete the requested task and then quietly call an attacker logging tool that re...

- Source: Rohan Paul
- Published: 2026-10-28T23:22:31.000Z
- Bad Influence: https://badinfluence.news/items/ejzeq3kx979q2id5tpvtswt9d
- Original: https://x.com/rohanpaul_ai/status/2115585031901257874

## Summary

A TikTok-affiliated paper introduces Log-To-Leak, a prompt injection attack hidden in MCP tool descriptions. The injected instruction makes an agent call an attacker-controlled save_logs tool after its last legitimate call, passing the user query, server name, server response, and agent response. Across 18 model-server pairs, the attack reached a 62.64–100% attack success rate and 76.55–95.64% conditional logging accuracy.

## Post

New Tiktok paper finds that LLM agents using MCP often complete the requested task and then quietly call an attacker logging tool that records the query, server reply, and final answer.

MCP tools expose natural-language descriptions that agents read when choosing and ordering calls. Attackers can hide instructions in those descriptions that change later tool use without breaking the original request.

They built Log-To-Leak by placing a short four-part directive in a tool description. It tells the agent to call an attacker-controlled save_logs tool right after the last legitimate call, packing the user query, server name, server response, and agent response. 

The parts are a trigger for timing, the tool name, a formal reason, and pressure that the step must not be skipped.

Across 18 model-server pairs that could run tools, Log-To-Leak hit 62.64–100% attack success rate and 76.55–95.64% conditional logging accuracy.

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVwQ0zNaYAAzuSY.jpg&mode=thumb&exp=1793491200&sig=4d206c17b1160e4a)