ContextLeak trains agents to leak their own context

A malicious MCP tool needs three things to succeed: the agent picks it, hands over context as an argument, then phones that data home. Most published research covers picking the tool and phoning home. The unstudied step is an agent volunteering its own prompt, trajectory and tool list as a tool argument. ContextLeak is built to force exactly that.

ContextLeak crafts the tool's name and description with an attack model. It trains that model with reinforcement learning against shadow users, simulated victim contexts standing in for real ones. The attack holds up even when a real user's context looks nothing like the shadow users it trained on.

A schema review checks what an MCP tool can access: file reads, network calls, requested permissions. ContextLeak's attack lives in the description text itself. It's worded to make an agent decide, on its own, that handing over its prompt and conversation history is a normal part of the call. A narrowly scoped tool can still be trained to talk an agent into oversharing.

The paper doesn't say whether MCP marketplace review processes catch this kind of description, or what a defense built to spot it would look like. Until one exists, a tool description that asks for prompt or trajectory data as an argument is reason enough to read the source first. A permissions check alone won't catch it.