The overlooked half of the malicious-MCP-tool attack is getting the agent to paste its own context into the arguments

arXiv 2608.27800·medium signalXBlueskyLinkedInCopy link

ContextLeak (arXiv 2608.27800, Aug 28) points out that context exfiltration via a malicious tool needs three conditions, and prior work covered only two: the agent selecting the tool, and the tool phoning home. The unstudied condition is the agent choosing to pass its runtime context (user prompt, execution trajectory, tool list) as input arguments. ContextLeak crafts the tool's name and description with an attack LLM fine-tuned by reinforcement learning against shadow users with diverse simulated contexts, using reward functions built specifically for the exfiltration objective, and stays effective when victim contexts differ substantially from the shadow set. The defensive implication for anyone installing third-party MCP servers: a schema audit that only asks what a tool does misses tools whose descriptions are engineered to make your agent volunteer its context.