{"slug": "tiktok-researchers-warn-that-mcp-tools-can-quietly-turn-ai-agents-against-their", "title": "TikTok researchers warn that MCP tools can quietly turn AI agents against their users", "summary": "TikTok's Privacy Innovation Lab published a paper on February 27, 2026, by Sirat Samyoun and Jian Du, titled \"When Tools Become Prompts: Why Multi-Turn MCP Systems Break Traditional Security Assumptions,\" showing that a malicious Model Context Protocol tool description can steer an LLM agent into forwarding user queries and its own responses to an attacker-controlled logging tool. The researchers also found sensitive fields such as social security numbers persist across multi-turn conversations and can leak across server boundaries, with legitimate responses from separate MCP servers combinable to reconstruct personally identifiable information even when the agent was told to withhold it. The paper argues that per-turn security checks miss cumulative risk, and cites MCPTox's reported average attack success rate of 36.5% across models for tool-description poisoning, a risk flagged since early 2025.", "body_md": "# TikTok researchers warn that MCP tools can quietly turn AI agents against their users\n\nPhoto: Kindel Media / Pexels\n\nA new paper from TikTok's Privacy Innovation Lab argues that multi-turn MCP systems break the security assumptions developers have been relying on\n\nAI agents are supposed to be helpful assistants. A new paper from TikTok researchers suggests they can also be very cooperative leakers.\n\nThe research shows that a malicious tool description can steer a large language model (LLM) agent into sending user queries and its own responses to a logging tool controlled by an attacker. The user asks a question, the agent answers, and a stranger quietly keeps a copy of the whole exchange.\n\n## What the TikTok paper found\n\nThe paper is titled “When Tools Become Prompts: Why Multi-Turn MCP Systems Break Traditional Security Assumptions.” It was released on February 27, 2026, by Sirat Samyoun and Jian Du of TikTok’s Privacy Innovation Lab.\n\nIts focus is the Model Context Protocol, or MCP. Think of MCP as a universal adapter that lets AI agents plug into outside tools and services during a conversation.\n\nThe paper’s title captures the core idea. A tool’s description is text the model reads, and text a model reads can function as an instruction.\n\nIf an attacker writes that description, they are effectively writing part of the prompt. The agent may then follow those buried directions, including the instruction to forward conversations to an attacker’s logging service.\n\n## Sensitive data that refuses to leave\n\nThe tool poisoning finding is only part of the story. The researchers also found that sensitive fields tend to persist across multi-turn conversations and can leak across server boundaries.\n\nTheir examples include social security numbers and other identifiers. Those details could be disclosed even when the agent had been explicitly told to leave sensitive information out.\n\n### AI, tech, and the markets they move—in one daily briefing.\n\nDaily. Free. Join 34,000+ readers across crypto, finance, and policy.\n\nThe team ran controlled experiments on public MCP servers and integrations. They showed that entirely legitimate tool responses could be combined to reconstruct personally identifiable information, or PII.\n\nNo single server had to hand over a full profile. Instead, data pulled from separate MCP servers could be pieced together, making indirect leakage worse.\n\n## Why per-turn security checks miss the problem\n\nThe paper’s sharpest critique is aimed at how MCP security is usually evaluated. Most assessments look at each turn of a conversation in isolation.\n\nThe researchers argue that this approach misses the cumulative risk. Exposure builds up across turns and across tools, and it only becomes visible when you examine the entire conversational history.\n\n## Background: a young standard with a growing attack surface\n\nMCP emerged as a standard in late 2024. It has since spread into popular tools such as Cursor and Claude Desktop.\n\nThe TikTok paper builds on a wave of security research that began in 2025. That earlier work raised concerns about tool-description poisoning and supply-chain vulnerabilities tied to MCP servers.\n\nTool-description poisoning has been flagged as a risk since early 2025. Benchmarks have put numbers on it, too: MCPTox reports an average attack success rate of 36.5% across models.\n\nWhat Samyoun and Du add is the multi-turn lens. Earlier concerns centered on whether a single tool could be trusted. This paper asks what happens when many tools and many turns interact over the life of a conversation.\n\n## What this means for developers and companies\n\nFor developers, the message is uncomfortable but clear. Vetting each tool individually and checking each response in isolation may not be enough.\n\nThe researchers call on everyone in the MCP ecosystem, from developers to end users, to rethink their security frameworks. In practice, that points toward treating tool descriptions as untrusted input and evaluating risk across the full conversation rather than turn by turn.\n\nIt also raises questions about the supply chain. When agents can connect to public MCP servers, every third-party tool is a potential entry point for poisoned instructions.\n\n**Disclosure:** This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our [Editorial Policy](https://cryptobriefing.com/editorial-policy/).\n\n## More in AI\n\n[See all](https://cryptobriefing.com/artificial-intelligence/)", "url": "https://wpnews.pro/news/tiktok-researchers-warn-that-mcp-tools-can-quietly-turn-ai-agents-against-their", "canonical_source": "https://cryptobriefing.com/tiktok-paper-mcp-llm-agent-security-risks/", "published_at": "2026-10-28 23:45:28+00:00", "updated_at": "2026-10-29 00:14:31.546906+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "agent-protocols", "large-language-models", "ai-ethics"], "entities": ["TikTok", "TikTok Privacy Innovation Lab", "Sirat Samyoun", "Jian Du", "Model Context Protocol", "Cursor", "Claude Desktop", "MCPTox"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/tiktok-researchers-warn-that-mcp-tools-can-quietly-turn-ai-agents-against-their", "markdown": "https://wpnews.pro/news/tiktok-researchers-warn-that-mcp-tools-can-quietly-turn-ai-agents-against-their.md", "text": "https://wpnews.pro/news/tiktok-researchers-warn-that-mcp-tools-can-quietly-turn-ai-agents-against-their.txt", "jsonld": "https://wpnews.pro/news/tiktok-researchers-warn-that-mcp-tools-can-quietly-turn-ai-agents-against-their.jsonld"}}