Definition
When a model can invoke functions, its output stops being text and becomes an action. Tool-call injection is the attempt to influence which function runs, and with what arguments, using content the model consumes.
Why this is the higher-consequence class
Disclosure attacks reveal information. Tool-call injection performs operations such as reading records, sending messages and modifying state, using the application's own privileges rather than the requester's. The gap between what the user is allowed to do and what the assistant is allowed to do becomes the vulnerability.
What contains it
- Tool privileges scoped to the requesting user, not to the application
- Confirmation for consequential or irreversible actions
- Retrieved content treated as data, never as instruction
- Argument validation independent of the model's suggestion
- Auditable records of which tool ran, with what, and why
- Malicious Content
- AI Agent
- Tool Call
- Sensitive System
Each hop validated by successful exploitation
Tags
- agents
- tool use
- indirect injection