AIAgent securityStory 05
An agent can finish the job and still leak data
What changedLog-To-Leak hides a logging instruction in MCP tool metadata. The agent completes the legitimate task, then makes a second call that sends selected context to an attacker. Across valid model-server pairs, the paper reports 62.64% to 100% attack success while ordinary task completion often barely changed.
The useful part
Why it matters
A successful tool result is not proof that the agent made only the calls the user authorized.
Keep in mind
Good to know
This is a controlled attack across five servers and four agents, not evidence that every MCP deployment is already compromised.
Evidence