TikTok researchers warn that MCP tools can quietly turn AI agents against their users

A new paper from TikTok's Privacy Innovation Lab argues that multi-turn MCP systems break the security assumptions developers have been relying on AI agents are supposed to be helpful assistants. A new paper from TikTok researchers suggests they can also be very cooperative leakers. The research shows that a malicious tool description can steer a large language model (LLM) agent into sending user queries and its own responses to a logging tool controlled by an attacker. The user asks a question, the agent answers, and a stranger quietly keeps a copy of the whole exchange. What the TikTok paper found The paper is titled “When Tools Become Prompts: Why Multi-Turn MCP Systems Break Traditional Security Assumptions.” It was released on February 27, 2026, by Sirat Samyoun and Jian Du of TikTok’s Privacy Innovation Lab. Its focus is the Model Context Protocol, or MCP. Think of MCP as a universal adapter that lets AI agents plug into outside tools and services during a conversation. The paper’s title captures the core idea. A tool’s description is text the model reads, and text a model reads can function as an instruction. If an attacker writes that description, they are effectively writi...