A new paper from TikTok's Privacy Innovation Lab argues that multi-turn MCP systems break the security assumptions developers have been relying on
AI agents are supposed to be helpful assistants. A new paper from TikTok researchers suggests they can also be very cooperative leakers.
The research shows that a malicious tool description can steer a large language model (LLM) agent into sending user queries and its own responses to a logging tool controlled by an attacker. The user asks a question, the agent answers, and a stranger quietly keeps a copy of the whole exchange.
What the TikTok paper found
The paper is titled “When Tools Become Prompts: Why Multi-Turn MCP Systems Break Traditional Security Assumptions.” It was released on February 27, 2026, by Sirat Samyoun and Jian Du of TikTok’s Privacy Innovation Lab.
Its focus is the Model Context Protocol, or MCP. Think of MCP as a universal adapter that lets AI agents plug into outside tools and services during a conversation.
The paper’s title captures the core idea. A tool’s description is text the model reads, and text a model reads can function as an instruction.
If an attacker writes that description, they are effectively writing part of the prompt. The agent may then follow those buried directions, including the instruction to forward conversations to an attacker’s logging service.
Sensitive data that refuses to leave
The tool poisoning finding is only part of the story. The researchers also found that sensitive fields tend to persist across multi-turn conversations and can leak across server boundaries.
Their examples include social security numbers and other identifiers. Those details could be disclosed even when the agent had been explicitly told to leave sensitive information out.
The team ran controlled experiments on public MCP servers and integrations. They showed that entirely legitimate tool responses could be combined to reconstruct personally identifiable information, or PII.
No single server had to hand over a full profile. Instead, data pulled from separate MCP servers could be pieced together, making indirect leakage worse.
Why per-turn security checks miss the problem
The paper’s sharpest critique is aimed at how MCP security is usually evaluated. Most assessments look at each turn of a conversation in isolation.
The researchers argue that this approach misses the cumulative risk. Exposure builds up across turns and across tools, and it only becomes visible when you examine the entire conversational history.
Background: a young standard with a growing attack surface
MCP emerged as a standard in late 2024. It has since spread into popular tools such as Cursor and Claude Desktop.
The TikTok paper builds on a wave of security research that began in 2025. That earlier work raised concerns about tool-description poisoning and supply-chain vulnerabilities tied to MCP servers.
Tool-description poisoning has been flagged as a risk since early 2025. Benchmarks have put numbers on it, too: MCPTox reports an average attack success rate of 36.5% across models.
What Samyoun and Du add is the multi-turn lens. Earlier concerns centered on whether a single tool could be trusted. This paper asks what happens when many tools and many turns interact over the life of a conversation.
What this means for developers and companies
For developers, the message is uncomfortable but clear. Vetting each tool individually and checking each response in isolation may not be enough.
The researchers call on everyone in the MCP ecosystem, from developers to end users, to rethink their security frameworks. In practice, that points toward treating tool descriptions as untrusted input and evaluating risk across the full conversation rather than turn by turn.
It also raises questions about the supply chain. When agents can connect to public MCP servers, every third-party tool is a potential entry point for poisoned instructions.
