How MCP servers can steal your conversation history

Summary: Trail of Bits researchers demonstrated an attack in which a malicious MCP server plants a trigger phrase in its tool description, causing the model to forward the user's entire conversation history to the attacker once the user organically types that phrase, such as "thank you." Because tool descriptions load into the context window as soon as the host connects to the server, the trigger is in place immediately on installation, and a single sustained connection could harvest weeks or months of conversations.
Bottom line: The researchers note that triggers can be tuned to fire on patterns like bank account numbers, Social Security Numbers, or AWS secret keys, and that stolen conversation history gives attackers the context to craft convincing follow-up phishing - so one installed server can quietly collect the exact data you would most want to keep.

Read the original at Trail of Bits Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026