Log-To-Leak attack makes AI agents send data to an attacker

Researchers tested Log-To-Leak, an attack on AI agents that use external tools through the Model Context Protocol (MCP), a standard to connect tools. The attack adds a tool call after the last correct one, and this tool call sends data to the attacker. On 18 pairs of model and server, it worked in 62.64% to 100% of tests.

How it works

The agent reads a text for each tool. The attack puts an instruction in this text. The instruction tells the agent to send these items to a server of the attacker:

• the user query
• the MCP server name
• the server response
• the agent response

The numbers

• Logging accuracy was 76.55% to 95.64%.
• With 3 defenses on GitHub MCP with GPT-4o, the attack worked in more than 55% of tests.
• A detector of instructions flagged 85.53% of tool texts that were safe.

What is not known

The paper gives no results for other servers or agents than these 5 servers and 4 agents. The authors say the host software must control the approval of each tool call after the last one.

Insight: The host software must guard tool calls

In Repeat-After-Me, 6 agent frameworks ran a tool call that the model wrote again. In INFUSE, a defense in the prompt cut the mean attack rate from 58.2% to 14.3%. Here, with 3 defenses on one test, the attack worked in more than 55% of tests. No defense is safe in all tests, and the safe gate reads as the host software, not the model. Leaders must find out who has that gate.