Researchers from TikTok’s Privacy Innovation Lab, Sirat Samyoun and Jian Du, published a paper on February 27, 2026, titled 'When Tools Become Prompts: Why Multi-Turn MCP Systems Break Traditional Security Assumptions.' The study examines security risks within the Model Context Protocol (MCP), a standard introduced in late 2024 that connects AI agents to external tools.
The authors demonstrate that malicious tool descriptions can function as hidden instructions, causing AI agents to forward user conversations to attacker-controlled logging services. This 'tool poisoning' allows unauthorized parties to capture entire exchanges between users and agents.
The research highlights that sensitive data, such as social security numbers, can leak across server boundaries during multi-turn conversations. Experiments showed that personally identifiable information can be reconstructed by combining data fragments pulled from multiple legitimate MCP servers, even when agents are instructed to withhold sensitive details.
The study critiques current security evaluations that analyze conversation turns in isolation, arguing that this method fails to account for cumulative risks. The researchers note that MCPTox benchmarks previously reported an average attack success rate of 36.5% for tool-description poisoning.
The team urges developers to treat tool descriptions as untrusted input and to evaluate risks across the entire conversation history. They emphasize that vetting individual tools is insufficient, as the integration of third-party public MCP servers creates potential entry points for poisoned instructions.
