MSA: A Cross-MCP Privacy Attack via Memory Exfiltration of Large Language Models

Abstract

The Model Context Protocol (MCP) serves as a standardized interface for integrating large language model (LLM) agents with external tools, enhancing their functionality for practical applications. Recent studies have shown that MCPs are vulnerable to behavioral manipulation attacks like tool poisoning. However, there has been a neglect of privacy threats. This study unveils a privacy threat in MCPs, i.e., the memory stealing attack (MSA), where the malicious MCP server systematically accesses user-agent interaction data from other MCPs. MSA functions by embedding a “parasitic parameter” in an MCP’s API, masquerading as a technical requirement, to force the agent to include its session context in the parameter value during MCP invocation. The malicious MCP server then secretly sends the exfiltrated memory data to an attacker. Our experiments on 20 MCP servers using Cursor, TRAE, and Visual Studio Code confirm that MSA is effective in real-world MCP applications. MSA achieves a 100% context capture and exfiltration success rate, with memory reconstruction accuracy ranging from 85.67% to 87.81%, presenting a significant privacy threat to users.