Hu, Yuepeng, Fan, Chongyu, Samyoun, Sirat, Du, Jian · Oct 26, 2026
Log-To-Leak studies prompt injection through the Model Context Protocol
Markdown · JSON · Original source
Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du study Log-To-Leak, a attack on agents that use the Model Context Protocol (MCP) to access tools. They describe an additive post-hoc logging attack: after an agent’s final legitimate tool call, an attacker-controlled call is induced to disclose information targeted by the payload. The authors evaluate five MCP servers and four LLM agents. Across 18 model-server pairs with valid tool execution, they report an attack success rate (ASR) of 62.64–100% and conditional logging accuracy (LA) of 76.55–95.64%. In 16 pairs, target-task completion changed by at most 6.63 percentage points, so task completion could remain largely intact while unauthorized disclosure occurred. The authors also report that three evaluated defenses left residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flagged 85.53% of benign descriptions. They argue these results motivate host-controlled authorization for secondary tool calls. The abstract does not specify how that authorization would work or how the attack and defenses perform beyond the tested settings.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Oct 26, 2026 (2026-10-26).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-07T09:46:27.966Z. First observed: 2026-10-28T04:18:45.295Z. Retrieved: 2026-10-30T20:31:39.393Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The evidence is the abstract; it does not provide the attack procedure, detailed evaluation methods, or the full results for each tested pair. The abstract does not describe how host-controlled authorization for secondary tool calls would work or report its effectiveness. The reported evaluation covers five MCP servers and four agents; the abstract does not establish how results generalize beyond the tested settings.
Open question
How would host-controlled authorization for secondary tool calls reduce disclosure without blocking legitimate calls?
Source-stated
The authors study an additive post-hoc logging attack that induces an attacker-controlled tool call after the agent's last legitimate call.
an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call
Source-stated
The authors report an attack success rate of 62.64–100% and conditional logging accuracy of 76.55–95.64% across 18 model-server pairs with valid tool execution.
Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64%
Source-stated
In 16 evaluated pairs, target-task completion changed by at most 6.63 percentage points, according to the authors.
16 pairs have absolute target-task completion changes of at most 6.63 percentage points
Source-stated
The authors report residual ASR above 55% for three evaluated defenses on GitHub MCP with GPT-4o, and that an instruction detector flagged 85.53% of benign descriptions.
Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions.
Source-stated
The authors argue that their results motivate host-controlled authorization for secondary tool calls.
These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls.
Source and contributor context
Hu, Yuepeng, Fan, Chongyu, Samyoun, Sirat, Du, Jian · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Large language model
A language model with many learned numerical settings, used to process and generate language.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: ea198b28-fc6f-4217-88dc-111702236579.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-07T09:46:27.966Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 7e554a1486c7f7a1105d041e9b40277624b6098472188f7723e31e64b508d3c3. Source text hash: d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02.
Revision and source-check history
Version 1 · 2026-11-07T09:46:27.966Z
Log-To-Leak studies prompt injection through the Model Context Protocol
Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du study Log-To-Leak, a attack on agents that use the Model Context Protocol (MCP) to access tools. They describe an additive post-hoc logging attack: after an agent’s final legitimate tool call, an attacker-controlled call is induced to disclose information targeted by the payload. The authors evaluate five MCP servers and four LLM agents. Across 18 model-server pairs with valid tool execution, they report an attack success rate (ASR) of 62.64–100% and conditional logging accuracy (LA) of 76.55–95.64%. In 16 pairs, target-task completion changed by at most 6.63 percentage points, so task completion could remain largely intact while unauthorized disclosure occurred. The authors also report that three evaluated defenses left residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flagged 85.53% of benign descriptions. They argue these results motivate host-controlled authorization for secondary tool calls. The abstract does not specify how that authorization would work or how the attack and defenses perform beyond the tested settings.
Original source
cs.AI · Article
Source details
Original source date: Oct 26, 2026 (2026-10-26).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-07T09:46:27.966Z. First observed: 2026-10-28T04:18:45.295Z. Retrieved: 2026-10-30T20:31:39.393Z.
Limits
The evidence is the abstract; it does not provide the attack procedure, detailed evaluation methods, or the full results for each tested pair. The abstract does not describe how host-controlled authorization for secondary tool calls would work or report its effectiveness. The reported evaluation covers five MCP servers and four agents; the abstract does not establish how results generalize beyond the tested settings.
Open question
How would host-controlled authorization for secondary tool calls reduce disclosure without blocking legitimate calls?
Source-stated
The authors study an additive post-hoc logging attack that induces an attacker-controlled tool call after the agent's last legitimate call.
an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call
Source-stated
The authors report an attack success rate of 62.64–100% and conditional logging accuracy of 76.55–95.64% across 18 model-server pairs with valid tool execution.
Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64%
Source-stated
In 16 evaluated pairs, target-task completion changed by at most 6.63 percentage points, according to the authors.
16 pairs have absolute target-task completion changes of at most 6.63 percentage points
Source-stated
The authors report residual ASR above 55% for three evaluated defenses on GitHub MCP with GPT-4o, and that an instruction detector flagged 85.53% of benign descriptions.
Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions.
Source-stated
The authors argue that their results motivate host-controlled authorization for secondary tool calls.
These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls.
Source and contributor context
Hu, Yuepeng, Fan, Chongyu, Samyoun, Sirat, Du, Jian · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Large language model
A language model with many learned numerical settings, used to process and generate language.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: ea198b28-fc6f-4217-88dc-111702236579.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-07T09:46:27.966Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 7e554a1486c7f7a1105d041e9b40277624b6098472188f7723e31e64b508d3c3. Source text hash: d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02.
uncertain · 2026-11-07T09:46:27.966Z · anthropic/claude-opus-5.5
Publication: ea198b28-fc6f-4217-88dc-111702236579
attribution — pass: The draft correctly names the four listed authors and attributes the attack study, metrics and recommendation to them as reported results and arguments.
Authors:Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du
summary — uncertain: The draft omits where the attack is planted: in the natural-language tool descriptions (metadata). Without that, a non-specialist cannot see why a detector was flagging 'benign descriptions'. The phrase 'information targeted by the payload' also hides what is leaked: the user query, MCP server name, server response and agent response. Prompt injection and LLM agent are not explained in plain words. Smallest repair: say that the attacker hides instructions in a tool's description, and list the leaked items. The title and question are otherwise faithful.
the natural-language metadata used to describe those tools creates a prompt-injection surface
date — pass: originalPublished is 2026-10-26, which matches the arXiv v1 submission date. The later feed date was not used.
[Submitted on 26 Oct 2026]
support — pass: All the figures match the abstract: 18 pairs, ASR 62.64-100%, LA 76.55-95.64%, 16 pairs within 6.63 points, residual ASR above 55%, and 85.53% of benign descriptions flagged. The coexistence inference follows the authors' own statement and is scoped to 16 pairs. The question and limitations do not overclaim.
These results show that successful task completion can coexist with unauthorized post-hoc disclosure
media — pass: The selected media is the verified, direct arXiv abstract page for this paper.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceA language model with many learned numerical settings, used to process and generate language.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivarXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivA language model with many learned numerical settings, used to process and generate language.
Definition referenceHidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceA language model with many learned numerical settings, used to process and generate language.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivarXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivA language model with many learned numerical settings, used to process and generate language.
Definition reference