Vulnerability / research

MCP study measures when synthetic secrets reach an external tool

Reported

Published here

What happened

Researchers tested 12 agent frameworks and 18 models to see whether agents would trust instructions from external tools. They tracked the difference between an agent requesting an action and test data actually leaving the environment.

Parties and reporting

Where this happened

Research, tests and decoys. Lab studies, demonstrations, sandboxed evaluations, honeypots and disclosed flaws without a documented real-world victim. There is no victim location to map. Explore the world map.

AI tools and systems: Model Context Protocol (MCP), 12 agent frameworks, 18 language models

Outcome

The researchers classified 2,113 test cases as susceptible. In 1,371 cases the agent dispatched a tool call, in 487 the test endpoint received network traffic, and in 255 it received the synthetic secret.

Operating lesson

Restrict which tools can receive sensitive data. Log both tool calls and outbound transfers so responders can distinguish a request from a confirmed disclosure.

Evidence and limits

November 2 is the date on the original arXiv preprint. The experiment used controlled configurations and synthetic secrets. The authors document no customer compromise or exposure rate for production systems.

Sources