Log To Leak Shows MCP Logs Can Steer Agents to Leak Data

The short version

Yuepeng Hu and colleagues describe prompt injection attacks that reach tool using agents through the Model Context Protocol. The paper posted on 26 October 2026 on arXiv. It is a preprint, not yet peer reviewed.

What the researchers did

The study Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol is arXiv 2610.36108. The prompt injection daily list shows a 26 October 2026 date. MCP is an open standard that lets agents call tools and read structured context from many apps.

The authors study how hostile text inside logs or tool outputs can steer an agent to leak secrets. The name Log-To-Leak highlights the path from poisoned log lines to exposed credentials. Agents often treat tool returns as trusted facts on the next turn, which creates a wide attack surface.

Photo: Tima Miroshnichenko / Pexels

What they found

The preprint reports attack success when MCP connected agents read injected log content. Model names and exact rates are in the PDF tables. The work complements gateway papers that sanitize tool channels but focuses on log delivery paths.

Defenders should treat every tool return as untrusted input. Filters on log streams, split instruction channels, and human approval before high risk tool calls are practical responses the paper motivates.

Red teams can replay the setup if they already expose MCP connectors to ticketing or devops logs.

Photo: Miguel Á. Padriñán / Pexels

Why it matters for you

Security teams rolling out MCP links for CRM, tickets, or build logs inherit indirect prompt injection risk. One poisoned line can ride into an agent with broad tool rights. CISOs should map which feeds enter model context without scrubbing.

Product owners must not assume single sign on alone blocks injection. Least privilege on tools and content scanning remain mandatory.

Archive the arXiv link in your agent threat model. Red team one MCP log source this quarter and record reachable tools after an injected line.

What to keep in mind

This is a preprint, not yet peer reviewed. Demos may use settings your deployment already blocks. The threat model still matches common MCP designs.

Pair the read with your own exercises on connected agents.

What a careful reader should do next

List every MCP feed that returns logs into an agent. Mark which tools that agent may call after reading a log line. Run one injected test string in staging and record whether secrets moved.

Key takeaways

• arXiv 2610.36108 dated 26 October 2026 covers Log-To-Leak on MCP agents.
• Injected log text can steer models to leak sensitive data.
• Treat tool and log channels as hostile input surfaces.
• Numeric results are in the PDF evaluation section.
• Combine content filters with strict tool scopes.

Sources

• Primary — arXiv, Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol (26 October 2026). Attack model and experiments.
• Secondary — GitHub daily list, 2610.36108 entry (28 October 2026). Confirms title, date, and identifier.