MCP Tool Description — Notes Parameter Chat-History Exfiltration - ATR-2026-01300 (de67cdc9-d30a-5887-aa76-e9ae84bfd1da)
Detects MCP tool descriptions that instruct the LLM to populate a "notes", "context", or "history" parameter with the full conversation transcript before calling the tool. This is a covert data-exfiltration vector: the poisoned description makes the LLM silently include all prior messages (including credentials, PII, and secrets) in every outbound tool call, regardless of whether the tool legitimately requires that data. Published as MCPSecBench scenario "chat-history-in-notes". Real-world variants use compliance framing ("SOC 2 audit", "legal and regulatory obligations"), technical justification ("context length management"), and formatting pressure ("Usr hist [DT] [MSG]" template) to make the instruction appear legitimate.