arXiv:2608. 10042v1 Announce Type: cross Abstract: Tool-use LLMs are increasingly asked to act on users' behalf, but existing benchmarks usually focus on profile recall, style imitation, generic tool use, or response-level personalization.
By Xuexiong Yin, Zechuan Chen, Yongsen Zheng, Yuxiang Zhang, Jingyuan Yang, Bin Wang, Yubin Wang, Keze Wang
The paper "Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol" investigates how natural-language metadata in the Model Context Protocol (MCP) can be exploited to inject malicious post‑hoc logging calls into large language model agents. The authors introduce the Log-To-Leak attack, which adds an attacker‑controlled call after a legitimate tool invocation, targeting user queries, MCP server names, server responses, and agent responses. Experiments across five MCP servers and four LLM agents show high attack success rates (up to 100%) and significant logging accuracy, while existing defenses still leave substantial residual risk.
By Yuepeng Hu, Chongyu Fan, Sirat Samyoun, Jian Du
arXiv:2606. 28061v1 Announce Type: cross Abstract: Large language models (LLMs) have increasingly moved from standalone text generation systems to agents that invoke external tools, access environments, and execute multi-step tasks.
By Shijing Hu, Liang Liu, Zhu Meng, Zhicheng Zhao
arXiv:2603. 07473v2 Announce Type: replace-cross Abstract: The Model Context Protocol (MCP) is an open and standardized interface that enables large language models (LLMs) to interact with external tools and services, and is increasingly adopted by AI agents.
By Yuhang Huang, Boyang Ma, Biwei Yan, Xuelong Dai, Yechao Zhang, Minghui Xu, Kaidi Xu, Yue Zhang
The paper introduces ASLEval, a framework for measuring privacy exposure displacement in large language model (LLM) agent sessions. It highlights that traditional local proxies—such as inspecting a single action or final response—often miss unauthorized data leaks elsewhere in a multi-step session. ASLEval pre-registers hidden target sets, tracks all declared visible exits, and preserves internal traces for diagnosis, revealing that a single outlet view can overlook nearly 47% of exposure and that internal evidence typically precedes visible leaks. The study underscores the need for benchmarks that define complete visible boundaries, ground claims in pre-specified targets, and report privacy alongside task utility.
By Guosen Wu, Huizhen Huang, Guoxiong Long, Tao Huang, Chen Hou
arXiv:2607. 25297v1 Announce Type: cross Abstract: The rapid development of large language model (LLM) agents has enabled their broad adoption across diverse real-world tasks.
By Ping He, Yuexiang Xie, Yaliang Li, Shouling Ji