ContextLeak: Malicious tools can exfiltrate 92% of Agent context
rohanpaul_ai · x · 2026-09-01
A paper titled "ContextLeak" reveals a new attack vector where malicious agent tools can exfiltrate sensitive runtime data (e.g., user prompts, conversation history) simply by having their names and descriptions crafted to trick the LLM agent into including them as tool arguments.
Attack Mechanics & Effectiveness:
- Attackers use RL to train an attack LLM that generates highly deceptive tool metadata.
- In default evaluations, the malicious tool was selected 92% of the time for user prompts and 89% for conversation history, with near-perfect reconstruction of sensitive content once selected.
- Cross-Model Transferability: The attack transfers across backend models. In a test against Claude Code (Claude Sonnet 4.6), a version trained only against an open-source proxy was selected in 22 out of 100 cases, achieving near-complete exfiltration upon selection.
Related event: ContextLeak Attack Lets Malicious Tools Steal Agents' Context(3 posts)→
More from Safety
- David Sacks: Anthropic blocking 90-99% of distillation proves regulation was never needed — AlexTensor · 2026-10-18
- Friends don't let friends feed their data to AI agents: Verge on Muse AI consent — IndependentCoast3974 · 2026-10-18
- Redditor proposes AI regulation framework: text detection, face verification, open algorithms — techtotechbytechy · 2026-10-18
- Prompt injection via email can hijack your AI agent — jev-guard adds risk-scored guards — sujingshen · 2026-10-18
- Users press OpenAI on long-delayed Adult Mode a year after it was promised — ___Patrice___ · 2026-10-18
- Viral AI safety report debunked: 'stolen keys' were just a 'test' string — basedjensen · 2026-10-18