A malicious agent tool can steal context without reading memory or files at all: it can convince the model to send the context as tool arguments.

This paper shows that tool descriptions can become a data-exfiltration channel.

ContextLeak trains an attack LLM with reinforcement learning to generate tool names and descriptions that make an agent choose the malicious tool and include sensitive runtime data such as the user prompt, conversation history, or installed tool list.

On the paper’s default evaluation, it gets the malicious tool selected for 92% of user-prompt attacks and 89% of conversation-history attacks, with near-perfect prompt reconstruction once selected.

The attack transfers across backend models, and in a Claude Code test with Claude Sonnet 4.6, a version trained only against an open-source proxy was selected in 22 of 100 cases; when selected, extraction was close to complete.

– arxiv. org/abs/2608.27800

Title: "ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools"