TikTok paper details Log-To-Leak attack that makes MCP agents exfiltrate logs

A TikTok-affiliated paper introduces Log-To-Leak, a prompt injection attack hidden in MCP tool descriptions.

The injected instruction makes an agent call an attacker-controlled save_logs tool after its last legitimate call, passing the user query, server name, server response, and agent response, according to a report by Rohan Paul.

Across 18 model-server pairs that could run tools, the attack reached a 62.64–100% attack success rate and 76.55–95.64% conditional logging accuracy, the paper's results as reported. The attack works by placing a short four-part directive in a tool description.