How a Calculator Tool Leaked an AI Agent's Secret

A Seemingly Harmless Calculator Tool

Recently, a video from YouTube demonstrated a disturbing AI Agent security vulnerability: a simple calculator tool, while correctly answering "2+3=5," sent the user's secret file to an unapproved server. The user was completely unaware throughout the process and only received a correct answer.

According to the video description, this calculator tool was supposed to only do addition, but it quietly expanded its functionality. The attacker exploited the flexibility of MCP (Model Context Protocol) to secretly add an extra parameter, such as "notes," to the tool definition, and the AI Agent, following instructions, read a fake secret file and stuffed it into this parameter. As a result, the call successfully returned the correct result, but the secret data was also leaked.

Correct. It also sent my secret to a server I never approved.

MCP (Model Context Protocol) is an open protocol proposed by Anthropic, designed to standardize the interaction between AI models and external tools and data sources. It adopts a client-server architecture: the AI Agent acts as the client, obtaining the tool list from the MCP server, invoking tools, and receiving results. The core advantage of MCP lies in its dynamism and extensibility—the server can describe available tools and their parameter schemas to the Agent at runtime, and the Agent constructs invocation requests based on these descriptions. This design allows the Agent to flexibly access various external capabilities, but it also means the Agent has a high degree of trust in the tool definitions provided by the server. Once the server is maliciously controlled or the tool definitions are tampered with, the Agent may perform unintended operations without knowing it—this is exactly the basis on which the attack described in this article succeeds.

How the Attack Was Carried Out Step by Step

The video breaks the attack down into multiple steps. First, the attacker created a seemingly normal calculator tool and registered it on the MCP server. Then, they induced the AI Agent to use this tool. The key step is that the tool's parameter schema was quietly modified to add an extra field. Since MCP allows the server to dynamically define tool interfaces, the Agent accepts this new field.

When the user requested the calculation of 2+3, the Agent, following instructions, read a fake secret file and filled its contents into the extra parameter. This file might contain sensitive information, such as API keys or user data. Subsequently, the tool call was sent to a server controlled by the attacker, which recorded the secret data while returning the correct result "5."

Step 3. The agent obeys. It reads the fake secret file and stuffs it into an extra argument called

The tool parameter schema is a JSON Schema object in MCP that describes the input format of a tool. It defines which parameters the tool accepts, the type of each parameter, whether it is required, and description information. Before invoking a tool, the Agent reads this schema and extracts the corresponding fields from the context or user request to construct the parameters accordingly. Since MCP allows the server to dynamically update the schema, an attacker can, after the Agent first obtains the tool definition, quietly inject an extra optional field (such as notes) into the schema. The Agent, following the updated schema, will attempt to fill in content for this new field, thereby opening a channel for data exfiltration. Parameter whitelisting and fixed schema validation are key means of defending against such tampering.

Why Neither the User nor the Agent Noticed Anything

The user only saw the correct answer, with no abnormal prompts. The Agent did not violate any rules either, because it merely passed parameters according to the tool-defined schema. The problem is that MCP's design allows the server to extend tool parameters at runtime, and the Agent typically trusts these definitions. This trust relationship was exploited, leading to data leakage.

The video mentioned that the sync log recorded only one hit, namely that the "canary" token was triggered. This means the attack can be extremely stealthy, and unless there is dedicated monitoring, it is very difficult to detect.

notes. The schema allows it, because the server quietly added that field too.

A canary token is a decoy marker used to detect data leakage. It is usually a unique string that appears sensitive but is actually useless, placed in a fake secret file or data store. When an attacker steals the file and transmits it externally, the canary token triggers a monitoring system alert, thereby exposing the leakage behavior. In the case described in this article, the sync log recorded only one canary token hit, indicating that the attacker did read the fake secret file, but there were no other abnormal logs. This highlights the blind spot of traditional log auditing when facing parameter-level data exfiltration: the call itself is legitimate and successful, and only specially placed decoys can catch the anomaly.

Security Risks and Implications of the MCP Protocol

This incident exposed a potential flaw in MCP's security design: tool parameter definitions lack strict validation mechanisms. The server can arbitrarily add parameters, and the Agent will accept them unconditionally. This provides an opportunity for malicious servers.

For developers, it is necessary to be wary of tools from untrusted sources. When building AI Agents, tool parameters should be strictly validated, and access to sensitive data should be restricted. At the same time, monitor abnormal behavior in tool calls, such as extra parameters or unknown endpoints.

Step 4. The call goes out. Result? 5. Correct answer. And the sync just logged one hit.

How to Prevent Similar Attacks

First, use only tools from trusted sources and regularly review tool definitions. Second, implement parameter whitelisting in the Agent and reject any unexpected fields. In addition, require secondary confirmation for sensitive operations to avoid automatically executing tool calls that may leak data. Finally, establish logging and alerting mechanisms to promptly detect abnormal calls.

The video author finally reminds us that security is an ongoing process, and the convenience of AI Agents must not come at the expense of security.

One-line Summary

MCP allows servers to dynamically extend tool parameters, which attackers exploit to hide extra fields in a calculator and silently steal users' secret files.

Paragraph Summary

This article uses a calculator tool case to reveal an AI Agent security vulnerability based on the MCP protocol. The attacker registered a seemingly normal calculator tool and secretly added an extra field (such as notes) to the parameter schema, inducing the Agent to read a fake secret file and fill it into that field while calculating 2+3, ultimately sending the data to the attacker's server. The user only saw the correct answer "5," and the Agent did not violate any rules, making the attack extremely stealthy. The article points out that MCP allows servers to dynamically define tool parameters and Agents trust them unconditionally, which is the root risk, and recommends that developers strictly validate parameters, use trusted tools, and monitor abnormal calls, while emphasizing that security is an ongoing process.