# Log-To-Leak studies prompt injection through the Model Context Protocol [Canonical reading](https://escapemeridian.com/readings/log-to-leak-studies-prompt-injection-through-the-model-context-b6c8ff5a) Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du study Log-To-Leak, a prompt-injection attack on LLM agents that use the Model Context Protocol (MCP) to access tools. They describe an additive post-hoc logging attack: after an agent’s final legitimate tool call, an attacker-controlled call is induced to disclose information targeted by the payload. The authors evaluate five MCP servers and four LLM agents. Across 18 model-server pairs with valid tool execution, they report an attack success rate (ASR) of 62.64–100% and conditional logging accuracy (LA) of 76.55–95.64%. In 16 pairs, target-task completion changed by at most 6.63 percentage points, so task completion could remain largely intact while unauthorized disclosure occurred. The authors also report that three evaluated defenses left residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flagged 85.53% of benign descriptions. They argue these results motivate host-controlled authorization for secondary tool calls. The abstract does not specify how that authorization would work or how the attack and defenses perform beyond the tested settings. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Oct 26, 2026 (2026-10-26). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-07T09:46:27.966Z. First observed: 2026-10-28T04:18:45.295Z. Retrieved: 2026-10-30T20:31:39.393Z. - [Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol](https://arxiv.org/abs/2610.36108) ## Limits The evidence is the arXiv abstract; it does not provide the attack procedure, detailed evaluation methods, or the full results for each tested pair. The abstract does not describe how host-controlled authorization for secondary tool calls would work or report its effectiveness. The reported evaluation covers five MCP servers and four LLM agents; the abstract does not establish how results generalize beyond the tested settings. ## Open question How would host-controlled authorization for secondary tool calls reduce disclosure without blocking legitimate calls? ## Source-stated The authors study an additive post-hoc logging attack that induces an attacker-controlled tool call after the agent's last legitimate call. > an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source-stated The authors report an attack success rate of 62.64–100% and conditional logging accuracy of 76.55–95.64% across 18 model-server pairs with valid tool execution. > Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64% - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source-stated In 16 evaluated pairs, target-task completion changed by at most 6.63 percentage points, according to the authors. > 16 pairs have absolute target-task completion changes of at most 6.63 percentage points - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source-stated The authors report residual ASR above 55% for three evaluated defenses on GitHub MCP with GPT-4o, and that an instruction detector flagged 85.53% of benign descriptions. > Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions. - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source-stated The authors argue that their results motivate host-controlled authorization for secondary tool calls. > These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls. - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source and contributor context Hu, Yuepeng, Fan, Chongyu, Samyoun, Sirat, Du, Jian · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Prompt injection Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it. - [Definition reference](https://en.wikipedia.org/wiki/Prompt_injection) ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: ea198b28-fc6f-4217-88dc-111702236579. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-07T09:46:27.966Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 7e554a1486c7f7a1105d041e9b40277624b6098472188f7723e31e64b508d3c3. Source text hash: d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02. ## Revision and source-check history ### Version 1 — 2026-11-07T09:46:27.966Z Yuepeng Hu, Chongyu Fan, Sirat Samyoun and Jian Du study Log-To-Leak, a prompt-injection attack on LLM agents that use the Model Context Protocol (MCP) to access tools. They describe an additive post-hoc logging attack: after an agent’s final legitimate tool call, an attacker-controlled call is induced to disclose information targeted by the payload. The authors evaluate five MCP servers and four LLM agents. Across 18 model-server pairs with valid tool execution, they report an attack success rate (ASR) of 62.64–100% and conditional logging accuracy (LA) of 76.55–95.64%. In 16 pairs, target-task completion changed by at most 6.63 percentage points, so task completion could remain largely intact while unauthorized disclosure occurred. The authors also report that three evaluated defenses left residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flagged 85.53% of benign descriptions. They argue these results motivate host-controlled authorization for secondary tool calls. The abstract does not specify how that authorization would work or how the attack and defenses perform beyond the tested settings. ## Original source arXiv cs.AI · Article Original source date: Oct 26, 2026 (2026-10-26). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-07T09:46:27.966Z. First observed: 2026-10-28T04:18:45.295Z. Retrieved: 2026-10-30T20:31:39.393Z. - [Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol](https://arxiv.org/abs/2610.36108) ## Limits The evidence is the arXiv abstract; it does not provide the attack procedure, detailed evaluation methods, or the full results for each tested pair. The abstract does not describe how host-controlled authorization for secondary tool calls would work or report its effectiveness. The reported evaluation covers five MCP servers and four LLM agents; the abstract does not establish how results generalize beyond the tested settings. ## Open question How would host-controlled authorization for secondary tool calls reduce disclosure without blocking legitimate calls? ## Source-stated The authors study an additive post-hoc logging attack that induces an attacker-controlled tool call after the agent's last legitimate call. > an additive post-hoc logging attack that induces a separate attacker-controlled call after the final legitimate call - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source-stated The authors report an attack success rate of 62.64–100% and conditional logging accuracy of 76.55–95.64% across 18 model-server pairs with valid tool execution. > Across 18 model-server pairs with valid tool execution, Log-To-Leak achieves an attack success rate (ASR) of 62.64-100% and conditional logging accuracy (LA) of 76.55-95.64% - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source-stated In 16 evaluated pairs, target-task completion changed by at most 6.63 percentage points, according to the authors. > 16 pairs have absolute target-task completion changes of at most 6.63 percentage points - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source-stated The authors report residual ASR above 55% for three evaluated defenses on GitHub MCP with GPT-4o, and that an instruction detector flagged 85.53% of benign descriptions. > Three evaluated defenses leave residual ASR above 55% on GitHub MCP with GPT-4o, while an instruction detector flags 85.53% of benign descriptions. - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source-stated The authors argue that their results motivate host-controlled authorization for secondary tool calls. > These results show that successful task completion can coexist with unauthorized post-hoc disclosure and motivate host-controlled authorization for secondary tool calls. - [Supporting source](https://arxiv.org/abs/2610.36108) ## Source and contributor context Hu, Yuepeng, Fan, Chongyu, Samyoun, Sirat, Du, Jian · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Prompt injection Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it. - [Definition reference](https://en.wikipedia.org/wiki/Prompt_injection) ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: ea198b28-fc6f-4217-88dc-111702236579. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-07T09:46:27.966Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 7e554a1486c7f7a1105d041e9b40277624b6098472188f7723e31e64b508d3c3. Source text hash: d1eba7a4ccbb0323989ba6fb8ba59fcc9c004213e9e0a7aea81abb4f750fff02. ### uncertain — 2026-11-07T09:46:27.966Z — anthropic/claude-opus-5.5 Publication: ea198b28-fc6f-4217-88dc-111702236579 attribution — pass: The draft correctly names the four listed authors and attributes the attack study, metrics and recommendation to them as reported results and arguments. > Authors:Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du summary — uncertain: The draft omits where the attack is planted: in the natural-language tool descriptions (metadata). Without that, a non-specialist cannot see why a detector was flagging 'benign descriptions'. The phrase 'information targeted by the payload' also hides what is leaked: the user query, MCP server name, server response and agent response. Prompt injection and LLM agent are not explained in plain words. Smallest repair: say that the attacker hides instructions in a tool's description, and list the leaked items. The title and question are otherwise faithful. > the natural-language metadata used to describe those tools creates a prompt-injection surface date — pass: originalPublished is 2026-10-26, which matches the arXiv v1 submission date. The later feed date was not used. > \[Submitted on 26 Oct 2026\] support — pass: All the figures match the abstract: 18 pairs, ASR 62.64-100%, LA 76.55-95.64%, 16 pairs within 6.63 points, residual ASR above 55%, and 85.53% of benign descriptions flagged. The coexistence inference follows the authors' own statement and is scoped to 16 pairs. The question and limitations do not overclaim. > These results show that successful task completion can coexist with unauthorized post-hoc disclosure media — pass: The selected media is the verified, direct arXiv abstract page for this paper. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/b6c8ff5aff30884e5014ffbdaf048df916875241f432e6c8b373f000fff56c62/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/log-to-leak-studies-prompt-injection-through-the-model-context-b6c8ff5a.json)