AI agents are designed to act as helpful assistants, but new research from TikTok suggests they can also serve as unwitting conduits for data theft. A paper from the company's Privacy Innovation Lab argues that multi-turn Model Context Protocol (MCP) systems break the security assumptions developers have been relying on.

According to the study, a malicious tool description can steer a large language model (LLM) agent into sending user queries and its own responses to a logging tool controlled by an attacker. The user asks a question, the agent answers, and a third party quietly retains a copy of the entire exchange.

What the paper found

The paper, titled "When Tools Become Prompts: Why Multi-Turn MCP Systems Break Traditional Security Assumptions," was released on February 27, 2026, by Sirat Samyoun and Jian Du of TikTok's Privacy Innovation Lab.

Its focus is the Model Context Protocol, a standard that functions as a universal adapter, allowing AI agents to plug into external tools and services during a conversation.

The title captures the core idea: a tool's description is text the model reads, and text a model reads can function as an instruction. If an attacker writes that description, they are effectively writing part of the prompt. The agent may then follow those buried directions, including an instruction to forward conversations to an attacker-controlled logging service.

Sensitive data that refuses to leave

Tool poisoning is only part of the story. The researchers also found that sensitive fields tend to persist across multi-turn conversations and can leak across server boundaries.

Their examples include social security numbers and other identifiers. Those details could be disclosed even when the agent had been explicitly told to leave sensitive information out.

The team ran controlled experiments on public MCP servers and integrations. They showed that entirely legitimate tool responses could be combined to reconstruct personally identifiable information (PII).

No single server had to hand over a full profile. Instead, data pulled from separate MCP servers could be pieced together, making indirect leakage worse. For anyone running an agent with multiple integrations, that means the exposure lies not in any single tool but in what several individually benign tools reveal in combination.

Why per-turn security checks miss the problem

The paper's sharpest critique is aimed at how MCP security is usually evaluated. Most assessments look at each turn of a conversation in isolation.

The researchers argue that this approach misses the cumulative risk. Exposure builds up across turns and across tools, and it only becomes visible when the entire conversational history is examined. By that logic, an audit that clears every individual turn could still miss leakage that surfaces only across a full session.

A young standard with a growing attack surface

MCP emerged as a standard in late 2024. It has since spread into popular tools such as Cursor and Claude Desktop. That reach places the paper's concerns inside software that many developers and end users already rely on.

The TikTok paper builds on a wave of security research that began in 2025. That earlier work raised concerns about tool-description poisoning and supply-chain vulnerabilities tied to MCP servers.

Tool-description poisoning has been flagged as a risk since early 2025. Benchmarks have put numbers on it as well: MCPTox reports an average attack success rate of 36.5% across models.

What Samyoun and Du add is the multi-turn lens. Earlier concerns centered on whether a single tool could be trusted. This paper asks what happens when many tools and many turns interact over the life of a conversation.

What this means for developers and companies

For developers, the message is uncomfortable but clear. Vetting each tool individually and checking each response in isolation may not be enough.

The researchers call on everyone in the MCP ecosystem, from developers to end users, to rethink their security frameworks. In practice, that points toward treating tool descriptions as untrusted input and evaluating risk across the full conversation rather than turn by turn.

The findings also raise supply-chain questions. When agents can connect to public MCP servers, every third-party tool is a potential entry point for poisoned instructions. The near-term question is whether practice follows the paper's advice — whether tool descriptions start being treated as untrusted input, and whether security reviews expand from single turns to entire conversations.