An agent's MCP tool calls alone let attackers infer user profiles 26.25% of the time
MCP, the Model Context Protocol, is how agents call outside tools. PrivacyTrace builds 1,000 synthetic user profiles and 4,000 agent trajectories using real tools from 25 servers, then asks attacking models to guess user attributes from the tool calls without seeing any conversation. They succeed 26.25% of the time, against 17.97% for guessing from priors. Tool arguments and returned results leak the most, and linking traces across sessions raises the risk further.