A side channel nobody designed
When an AI agent uses external tools through a protocol such as the Model Context Protocol, it leaves a trail: which tool it called, with what arguments, and what came back. A paper posted to arXiv on 30 October asks what an observer could learn about the user from that trail alone, without ever seeing the conversation.
The answer is: more than chance, consistently. The authors built PrivacyTrace, a benchmark of 1,000 synthetic user profiles and 4,000 agent trajectories across four domains, generated using real MCP tools drawn from 25 servers. Four mainstream language models were then set to infer user attributes from the traces.
The numbers
Across those attackers, inferring a user’s profile from protocol-valid tool-call traces succeeded 26.25% of the time. The comparison the authors give is guessing from priors alone — what you would get by betting on base rates with no trace at all — which succeeded 17.97% of the time.
That is an eight-point lift from data that no part of the system treats as sensitive. Tool calls are not transcripts; they are the plumbing, and they are routinely logged, proxied and observed by infrastructure that would never be given access to a user’s messages.
Where the signal is
The paper locates the leak specifically. Tool arguments and returned results carry most of the trace-grounded evidence — the parameters an agent passes, and what the tool hands back. The tool names alone are less revealing than what is passed through them.
The second finding is about accumulation. Linking traces across sessions amplifies the profiling risk further. A single session is a weak signal; the same user observed repeatedly is not.
What the design does and does not settle
The profiles are synthetic and the trajectories are generated, which is what makes a controlled measurement possible and also what limits it. A 26.25% success rate on a constructed benchmark is a demonstration that the channel carries signal, not an estimate of real-world exposure. The attackers are off-the-shelf models rather than a motivated adversary with domain knowledge, which cuts the other way.
The authors have released code and data, which is the part that makes the result checkable rather than quotable.
Why this lands now
MCP has become the default way agents reach external tools, and the deployment pattern that comes with it puts tool-call traffic in places user conversations never go: gateway logs, observability pipelines, third-party tool servers. Each of those is a vantage point that the paper’s threat model describes.
What to watch
The practical question is whether anyone treats tool-call logs as personal data. Nothing in the protocol requires it, retention policies for agent telemetry are mostly unwritten, and the finding that cross-session linking amplifies inference points directly at the logs that are kept longest. Watch for privacy-aware mechanisms at the protocol level rather than at the application level — and for the first regulator to ask an agent vendor what is in its traces.
