Trivial Trojans: How Minimal MCP Servers Enable Cross-Tool Exfiltration of Sensitive Data