// ContextLeak in AI Agents //

The whole attack surface here is a tool name and a tool description.

Stealing an LLM agent's runtime context, meaning the user prompt, the execution trajectory and the tool list, needs three things to line up.

The agent has to pick the malicious tool, it has to pass its context in as arguments, and the tool has to forward that anywhere the attacker wants.

Existing work covers the first and third conditions and leaves the second one mostly alone.

ContextLeak targets the middle step.

Researchers at Duke use an attack LLM to generate the malicious tool's name and description, then fine-tune that LLM with reinforcement learning on a set of shadow users with diverse simulated agent contexts. The reward functions are built specifically for the exfiltration objective.

It remains highly effective when the shadow contexts differ substantially from the victim's, and it outperforms existing malicious-tool attacks adapted to this setting.

Paper: https://arxiv.org/abs/2608.27800

Chat with Paper: https://academy.dair.ai/papers/contextleak-exfiltrating-llm-agent-context-via-malicious-tools-2608.27800