{"id":"b6c8ff5aff30884e5014ffbdaf048df916875241f432e6c8b373f000fff56c62","title":"Log-To-Leak studies prompt injection through the Model Context Protocol","argument":"Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du study Log-To-Leak, a prompt-injection attack on LLM agents that use the Model Context Protocol (MCP) to access tools. They describe an additive post-hoc logging attack: after an agent’s final legitimate tool call, an attacker-controlled call is induced to disclose information targeted by the payload. The authors evaluate five MCP servers and four LLM agents. Across 18 model-server pairs with valid tool execution, they report an attack success rate (ASR) of 62.64–100% and conditional logging accuracy (LA) of 76.55–95.64%. In 16 pairs, target-task completion changed by at most 6.63 percentage points, so task completion could remain largely intact while unauthorized disclosure occurred. The authors also report that three evaluated defenses left residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flagged 85.53% of benign descriptions. They argue these results motivate host-controlled authorization for secondary tool calls. The abstract does not specify how that authorization would work or how the attack and defenses perform beyond the tested settings.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The evidence is the arXiv abstract; it does not provide the attack procedure, detailed evaluation methods, or the full results for each tested pair. The abstract does not describe how host-controlled authorization for secondary tool calls would work or report its effectiveness. The reported evaluation covers five MCP servers and four LLM agents; the abstract does not establish how results generalize beyond the tested settings.","speaker":{"name":"Hu, Yuepeng, Fan, Chongyu, Samyoun, Sirat, Du, Jian","roleAtSource":"Article author"},"source":{"title":"Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.36108","publishedAt":"2026-10-26","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors study an additive post-hoc logging attack that induces an attacker-controlled tool call after the agent's last legitimate call.","excerpt":"an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"},{"text":"The authors report an attack success rate of 62.64–100% and conditional logging accuracy of 76.55–95.64% across 18 model-server pairs with valid tool execution.","excerpt":"Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64%","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"},{"text":"In 16 evaluated pairs, target-task completion changed by at most 6.63 percentage points, according to the authors.","excerpt":"16 pairs have absolute target-task completion changes of at most 6.63 percentage points","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"},{"text":"The authors report residual ASR above 55% for three evaluated defenses on GitHub MCP with GPT-4o, and that an instruction detector flagged 85.53% of benign descriptions.","excerpt":"Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions.","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"},{"text":"The authors argue that their results motivate host-controlled authorization for secondary tool calls.","excerpt":"These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls.","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.36108","checkedAt":"2026-11-07T10:50:07.890Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would host-controlled authorization for secondary tool calls reduce disclosure without blocking legitimate calls?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Log-To-Leak studies prompt injection through the Model Context Protocol","summary":"Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du study Log-To-Leak, a prompt-injection attack on LLM agents that use the Model Context Protocol (MCP) to access tools. They describe an additive post-hoc logging attack: after an agent’s final legitimate tool call, an attacker-controlled call is induced to disclose information targeted by the payload. The authors evaluate five MCP servers and four LLM agents. Across 18 model-server pairs with valid tool execution, they report an attack success rate (ASR) of 62.64–100% and conditional logging accuracy (LA) of 76.55–95.64%. In 16 pairs, target-task completion changed by at most 6.63 percentage points, so task completion could remain largely intact while unauthorized disclosure occurred. The authors also report that three evaluated defenses left residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flagged 85.53% of benign descriptions. They argue these results motivate host-controlled authorization for secondary tool calls. The abstract does not specify how that authorization would work or how the attack and defenses perform beyond the tested settings.","question":"How would host-controlled authorization for secondary tool calls reduce disclosure without blocking legitimate calls?","claims":[{"text":"The authors study an additive post-hoc logging attack that induces an attacker-controlled tool call after the agent's last legitimate call.","excerpt":"an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call","support":"source-stated"},{"text":"The authors report an attack success rate of 62.64–100% and conditional logging accuracy of 76.55–95.64% across 18 model-server pairs with valid tool execution.","excerpt":"Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64%","support":"source-stated"},{"text":"In 16 evaluated pairs, target-task completion changed by at most 6.63 percentage points, according to the authors.","excerpt":"16 pairs have absolute target-task completion changes of at most 6.63 percentage points","support":"source-stated"},{"text":"The authors report residual ASR above 55% for three evaluated defenses on GitHub MCP with GPT-4o, and that an instruction detector flagged 85.53% of benign descriptions.","excerpt":"Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions.","support":"source-stated"},{"text":"The authors argue that their results motivate host-controlled authorization for secondary tool calls.","excerpt":"These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls.","support":"source-stated"}],"limitations":["The evidence is the arXiv abstract; it does not provide the attack procedure, detailed evaluation methods, or the full results for each tested pair.","The abstract does not describe how host-controlled authorization for secondary tool calls would work or report its effectiveness.","The reported evaluation covers five MCP servers and four LLM agents; the abstract does not establish how results generalize beyond the tested settings."],"mediaId":"741ed610cf272b09e2aa83221a3a63675aa6b393441ed3f37680f0ac1ff7312e","correctionReason":null,"id":"b6c8ff5aff30884e5014ffbdaf048df916875241f432e6c8b373f000fff56c62","publicationId":"ea198b28-fc6f-4217-88dc-111702236579","version":1,"sourceUrl":"https://arxiv.org/abs/2610.36108","sourceTitle":"Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-26","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-28T04:18:45.295Z","createdAt":"2026-11-07T09:46:27.966Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"741ed610cf272b09e2aa83221a3a63675aa6b393441ed3f37680f0ac1ff7312e","kind":"article","url":"https://arxiv.org/abs/2610.36108","sourceUrl":"https://arxiv.org/abs/2610.36108","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-30T20:31:39.445Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.36108","checkedAt":"2026-11-07T10:50:07.890Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"741ed610cf272b09e2aa83221a3a63675aa6b393441ed3f37680f0ac1ff7312e","confidence":0.89,"provider":"typesafe","model":"jev-1.13.0","inputHash":"23b771a033557ec0be186dfb2c978b6c3d6cdf2f5cb600d3aeff41534c607f77","decidedAt":"2026-10-30T20:31:39.851Z"},"provenance":{"textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observationId":"7e554a1486c7f7a1105d041e9b40277624b6098472188f7723e31e64b508d3c3","retrievedAt":"2026-10-30T20:31:39.393Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"9b8e1435-957a-447a-8363-f35b5c884963"},"reviewer":{"model":"gpt-6-luna","runId":"2f569c03-cc78-4c58-8973-8ecfff123589"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-07T09:46:27.966Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Hu, Yuepeng","url":null,"kind":"unknown"},{"name":"Fan, Chongyu","url":null,"kind":"unknown"},{"name":"Samyoun, Sirat","url":null,"kind":"unknown"},{"name":"Du, Jian","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Hu, Yuepeng","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Hu, Yuepeng","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.36108","locator":"head/meta[name=author|citation_author]"},"assertionId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-07T10:50:07.890Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","sourceUrl":"https://arxiv.org/abs/2610.36108","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z"}},{"actor":{"name":"Fan, Chongyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Fan, Chongyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.36108","locator":"head/meta[name=author|citation_author]"},"assertionId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-07T10:50:07.890Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","sourceUrl":"https://arxiv.org/abs/2610.36108","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z"}},{"actor":{"name":"Samyoun, Sirat","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Samyoun, Sirat","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.36108","locator":"head/meta[name=author|citation_author]"},"assertionId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-07T10:50:07.890Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","sourceUrl":"https://arxiv.org/abs/2610.36108","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z"}},{"actor":{"name":"Du, Jian","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Du, Jian","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.36108","locator":"head/meta[name=author|citation_author]"},"assertionId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-07T10:50:07.890Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","sourceUrl":"https://arxiv.org/abs/2610.36108","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.36108","snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z","basis":"publisher-page-metadata","sourceLinks":43,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/b6c8ff5aff30884e5014ffbdaf048df916875241f432e6c8b373f000fff56c62/source"}},"canonicalUrl":"https://escapemeridian.com/readings/log-to-leak-studies-prompt-injection-through-the-model-context-b6c8ff5a","formats":{"html":"/readings/log-to-leak-studies-prompt-injection-through-the-model-context-b6c8ff5a","markdown":"/readings/log-to-leak-studies-prompt-injection-through-the-model-context-b6c8ff5a.md","json":"/readings/log-to-leak-studies-prompt-injection-through-the-model-context-b6c8ff5a.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-prompt-injection","name":"Prompt injection","explanation":"Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.","referenceUrl":"https://en.wikipedia.org/wiki/Prompt_injection"},{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"b6c8ff5aff30884e5014ffbdaf048df916875241f432e6c8b373f000fff56c62","revision":"ea198b28-fc6f-4217-88dc-111702236579","revisionKind":"publication-id","title":"Log-To-Leak studies prompt injection through the Model Context Protocol","url":"https://escapemeridian.com/readings/log-to-leak-studies-prompt-injection-through-the-model-context-b6c8ff5a"},"source":{"type":"source","id":"https://arxiv.org/abs/2610.36108","revision":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","revisionKind":"sha256-source-text","title":"Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol","url":"https://arxiv.org/abs/2610.36108"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"b6c8ff5aff30884e5014ffbdaf048df916875241f432e6c8b373f000fff56c62","title":"Log-To-Leak studies prompt injection through the Model Context Protocol","argument":"Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du study Log-To-Leak, a prompt-injection attack on LLM agents that use the Model Context Protocol (MCP) to access tools. They describe an additive post-hoc logging attack: after an agent’s final legitimate tool call, an attacker-controlled call is induced to disclose information targeted by the payload. The authors evaluate five MCP servers and four LLM agents. Across 18 model-server pairs with valid tool execution, they report an attack success rate (ASR) of 62.64–100% and conditional logging accuracy (LA) of 76.55–95.64%. In 16 pairs, target-task completion changed by at most 6.63 percentage points, so task completion could remain largely intact while unauthorized disclosure occurred. The authors also report that three evaluated defenses left residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flagged 85.53% of benign descriptions. They argue these results motivate host-controlled authorization for secondary tool calls. The abstract does not specify how that authorization would work or how the attack and defenses perform beyond the tested settings.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The evidence is the arXiv abstract; it does not provide the attack procedure, detailed evaluation methods, or the full results for each tested pair. The abstract does not describe how host-controlled authorization for secondary tool calls would work or report its effectiveness. The reported evaluation covers five MCP servers and four LLM agents; the abstract does not establish how results generalize beyond the tested settings.","speaker":{"name":"Hu, Yuepeng, Fan, Chongyu, Samyoun, Sirat, Du, Jian","roleAtSource":"Article author"},"source":{"title":"Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.36108","publishedAt":"2026-10-26","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors study an additive post-hoc logging attack that induces an attacker-controlled tool call after the agent's last legitimate call.","excerpt":"an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"},{"text":"The authors report an attack success rate of 62.64–100% and conditional logging accuracy of 76.55–95.64% across 18 model-server pairs with valid tool execution.","excerpt":"Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64%","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"},{"text":"In 16 evaluated pairs, target-task completion changed by at most 6.63 percentage points, according to the authors.","excerpt":"16 pairs have absolute target-task completion changes of at most 6.63 percentage points","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"},{"text":"The authors report residual ASR above 55% for three evaluated defenses on GitHub MCP with GPT-4o, and that an instruction detector flagged 85.53% of benign descriptions.","excerpt":"Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions.","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"},{"text":"The authors argue that their results motivate host-controlled authorization for secondary tool calls.","excerpt":"These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls.","url":"https://arxiv.org/abs/2610.36108","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.36108","checkedAt":"2026-11-07T10:50:07.890Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would host-controlled authorization for secondary tool calls reduce disclosure without blocking legitimate calls?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Log-To-Leak studies prompt injection through the Model Context Protocol","summary":"Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du study Log-To-Leak, a prompt-injection attack on LLM agents that use the Model Context Protocol (MCP) to access tools. They describe an additive post-hoc logging attack: after an agent’s final legitimate tool call, an attacker-controlled call is induced to disclose information targeted by the payload. The authors evaluate five MCP servers and four LLM agents. Across 18 model-server pairs with valid tool execution, they report an attack success rate (ASR) of 62.64–100% and conditional logging accuracy (LA) of 76.55–95.64%. In 16 pairs, target-task completion changed by at most 6.63 percentage points, so task completion could remain largely intact while unauthorized disclosure occurred. The authors also report that three evaluated defenses left residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flagged 85.53% of benign descriptions. They argue these results motivate host-controlled authorization for secondary tool calls. The abstract does not specify how that authorization would work or how the attack and defenses perform beyond the tested settings.","question":"How would host-controlled authorization for secondary tool calls reduce disclosure without blocking legitimate calls?","claims":[{"text":"The authors study an additive post-hoc logging attack that induces an attacker-controlled tool call after the agent's last legitimate call.","excerpt":"an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call","support":"source-stated"},{"text":"The authors report an attack success rate of 62.64–100% and conditional logging accuracy of 76.55–95.64% across 18 model-server pairs with valid tool execution.","excerpt":"Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64%","support":"source-stated"},{"text":"In 16 evaluated pairs, target-task completion changed by at most 6.63 percentage points, according to the authors.","excerpt":"16 pairs have absolute target-task completion changes of at most 6.63 percentage points","support":"source-stated"},{"text":"The authors report residual ASR above 55% for three evaluated defenses on GitHub MCP with GPT-4o, and that an instruction detector flagged 85.53% of benign descriptions.","excerpt":"Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions.","support":"source-stated"},{"text":"The authors argue that their results motivate host-controlled authorization for secondary tool calls.","excerpt":"These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls.","support":"source-stated"}],"limitations":["The evidence is the arXiv abstract; it does not provide the attack procedure, detailed evaluation methods, or the full results for each tested pair.","The abstract does not describe how host-controlled authorization for secondary tool calls would work or report its effectiveness.","The reported evaluation covers five MCP servers and four LLM agents; the abstract does not establish how results generalize beyond the tested settings."],"mediaId":"741ed610cf272b09e2aa83221a3a63675aa6b393441ed3f37680f0ac1ff7312e","correctionReason":null,"id":"b6c8ff5aff30884e5014ffbdaf048df916875241f432e6c8b373f000fff56c62","publicationId":"ea198b28-fc6f-4217-88dc-111702236579","version":1,"sourceUrl":"https://arxiv.org/abs/2610.36108","sourceTitle":"Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-26","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-28T04:18:45.295Z","createdAt":"2026-11-07T09:46:27.966Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"741ed610cf272b09e2aa83221a3a63675aa6b393441ed3f37680f0ac1ff7312e","kind":"article","url":"https://arxiv.org/abs/2610.36108","sourceUrl":"https://arxiv.org/abs/2610.36108","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-30T20:31:39.445Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.36108","checkedAt":"2026-11-07T10:50:07.890Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"741ed610cf272b09e2aa83221a3a63675aa6b393441ed3f37680f0ac1ff7312e","confidence":0.89,"provider":"typesafe","model":"jev-1.13.0","inputHash":"23b771a033557ec0be186dfb2c978b6c3d6cdf2f5cb600d3aeff41534c607f77","decidedAt":"2026-10-30T20:31:39.851Z"},"provenance":{"textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observationId":"7e554a1486c7f7a1105d041e9b40277624b6098472188f7723e31e64b508d3c3","retrievedAt":"2026-10-30T20:31:39.393Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"9b8e1435-957a-447a-8363-f35b5c884963"},"reviewer":{"model":"gpt-6-luna","runId":"2f569c03-cc78-4c58-8973-8ecfff123589"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-07T09:46:27.966Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Hu, Yuepeng","url":null,"kind":"unknown"},{"name":"Fan, Chongyu","url":null,"kind":"unknown"},{"name":"Samyoun, Sirat","url":null,"kind":"unknown"},{"name":"Du, Jian","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Hu, Yuepeng","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Hu, Yuepeng","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.36108","locator":"head/meta[name=author|citation_author]"},"assertionId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-07T10:50:07.890Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","sourceUrl":"https://arxiv.org/abs/2610.36108","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z"}},{"actor":{"name":"Fan, Chongyu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Fan, Chongyu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.36108","locator":"head/meta[name=author|citation_author]"},"assertionId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-07T10:50:07.890Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","sourceUrl":"https://arxiv.org/abs/2610.36108","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z"}},{"actor":{"name":"Samyoun, Sirat","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Samyoun, Sirat","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.36108","locator":"head/meta[name=author|citation_author]"},"assertionId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-07T10:50:07.890Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","sourceUrl":"https://arxiv.org/abs/2610.36108","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z"}},{"actor":{"name":"Du, Jian","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Du, Jian","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.36108","locator":"head/meta[name=author|citation_author]"},"assertionId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-07T10:50:07.890Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","sourceUrl":"https://arxiv.org/abs/2610.36108","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.36108","snapshotId":"ee6cd94201c8c477639d373a1c64c3e80bce0c144f707f814cedcfcdb3880232","contentSha256":"c6871435cf142d1392d85f39bab8111c708c06addc0988a4028f6134d88251fe","textHash":"d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02","observedAt":"2026-11-07T10:50:07.890Z","basis":"publisher-page-metadata","sourceLinks":43,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/b6c8ff5aff30884e5014ffbdaf048df916875241f432e6c8b373f000fff56c62/source"}}}],"audits":[{"publicationId":"ea198b28-fc6f-4217-88dc-111702236579","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The draft correctly names the four listed authors and attributes the attack study, metrics and recommendation to them as reported results and arguments.","excerpt":"Authors:Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du"},{"dimension":"summary","status":"uncertain","explanation":"The draft omits where the attack is planted: in the natural-language tool descriptions (metadata). Without that, a non-specialist cannot see why a detector was flagging 'benign descriptions'. The phrase 'information targeted by the payload' also hides what is leaked: the user query, MCP server name, server response and agent response. Prompt injection and LLM agent are not explained in plain words. Smallest repair: say that the attacker hides instructions in a tool's description, and list the leaked items. The title and question are otherwise faithful.","excerpt":"the natural-language metadata used to describe those tools creates a prompt-injection surface"},{"dimension":"date","status":"pass","explanation":"originalPublished is 2026-10-26, which matches the arXiv v1 submission date. The later feed date was not used.","excerpt":"[Submitted on 26 Oct 2026]"},{"dimension":"support","status":"pass","explanation":"All the figures match the abstract: 18 pairs, ASR 62.64-100%, LA 76.55-95.64%, 16 pairs within 6.63 points, residual ASR above 55%, and 85.53% of benign descriptions flagged. The coexistence inference follows the authors' own statement and is scoped to 16 pairs. The question and limitations do not overclaim.","excerpt":"These results show that successful task completion can coexist with unauthorized post-hoc disclosure"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified, direct arXiv abstract page for this paper.","excerpt":null}],"createdAt":"2026-11-07T09:46:27.966Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}