A study from TikTok’s Privacy Innovation Lab, published on February 27, 2026 by Sirat Samyoun and Jian Du, shows that a malicious tool description can steer an AI agent into sending a user’s questions and responses to a logging service controlled by an attacker. The researchers also found that sensitive data can persist across conversation turns and leak between different MCP servers. Responses from legitimate servers can be combined to reconstruct personally identifiable information, even though no single server provides a complete profile. The study argues that security evaluations focused on individual turns miss cumulative exposure across tools and turns, while the MCPTox benchmark reports an average attack success rate of 36.5%.
Source: Read the original article
