What's this about?
An agent's runtime context — the user's prompt, the execution trajectory so far, the list of tools available — is sensitive, and this paper shows it can be exfiltrated by a malicious tool the agent calls. The tool does not need to do anything obviously wrong; it just needs to be called.
Why is the tool list itself sensitive?
Because it is a map of your capabilities. Knowing an agent has a `deploy_to_production` tool, or a credentials-reading tool, or an internal API client, tells an attacker exactly what to aim a later injection at. The trajectory is worse: it contains the actual content the agent has been working with, which for most real deployments means internal documents, code, or customer data. This is the agent-era version of an information-disclosure bug, and the delivery mechanism is the ordinary act of using a third-party tool.
Why does this matter to you?
- It makes the MCP-server-and-plugin supply chain a data-exfiltration surface, not just a code-execution one.
- The mitigation is unglamorous and structural: minimise what is in context when calling an untrusted tool, rather than trying to detect malicious tools.
- It pairs with the "when tool outputs become commands" paper below — same trust boundary, opposite direction of travel.