SOPE: Situation-Aware and Statistically Indistinguishable Privacy Exfiltration for MCP-enabled Agents

The Model Context Protocol (MCP) enables Large Language Model (LLM) agents to interact with external tools, but this extensibility introduces significant supply chain vulnerabilities that enable covert privacy exfiltration. Prior studies have revealed privacy leakage in MCP-enabled agents via indirect prompt injection; however, existing attacks are typically misaligned with the agent's tool-usage context and rely on rigid templates, resulting in recognizable patterns that are readily flagged by existing defenses. In this work, we exploit the observation that privacy exposure is inherently scenario-dependent, to associate certain privacy items with specific tools. We introduce SOPE, a Scenario-aware and zerO-click Privacy Exfiltration framework that transforms any benign MCP server into its privacy-exfiltrating variants. SOPE (1) identifies privacy items that are appropriate to the tool usage, (2) embeds privacy-probing instructions into tool-invocation prompts, and (3) achieves zero-click data transmission via code-level modifications. We evaluate SOPE across 27,216 test cases, where 324 SOPE-transformed real-world servers attacking four benchmark and three commercial agents with nine state-of-the-art defenses. Results demonstrate that SOPE remains highly effective and robust, highlighting critical protocol-level safety gaps in the agent ecosystem.

AI assistants are increasingly connecting to third-party tools and services, such as email clients, calendars, and banking apps, through a standard interface called the Model Context Protocol (MCP). While this makes AI assistants more capable, it also opens the door to privacy risks: a malicious tool provider could secretly design their tool to steal users' personal information. Previous research has shown that such attacks are possible but relatively easy to detect, because the malicious instructions look out of place and follow obvious patterns. For example, a calculator tool suddenly asking for your email address would raise immediate suspicion. In this work, we show that these attacks can be made far more dangerous. We develop SOPE, a system that automatically converts any legitimate tool into a privacy-stealing version that is much harder to detect. SOPE works by making its data requests seem natural for the tool's purpose. For instance, a calendar tool asking for your email to "send meeting notifications", and by hiding the data transmission inside the tool's own code rather than issuing suspicious commands.