How the attack works
An attacker publishes or modifies a tool so its description includes wording aimed at the LLM reading it, not the end user. The instructions tell the model to automatically chain output into another tool or send it to an external destination, and to do so without asking the user first. Because agents often treat tool descriptions as trusted configuration rather than untrusted input, the model complies. This creates a silent data path from whatever the agent is processing to wherever the attacker wants it, bypassing the consent prompt users normally rely on.
Why it matters
Sensitive data the agent handles can be exfiltrated to an external endpoint or a chained tool without the user ever seeing or approving the transfer.
What you can do
- Review tool descriptions in your agent's toolset for language instructing automatic forwarding or explicitly telling the model to skip confirmation.
- Treat tool descriptions as untrusted input and enforce consent checks at the agent/orchestration layer rather than trusting instructions embedded in tool metadata.
- Require explicit user approval before any tool output is passed to another tool or sent externally, regardless of what the tool's own description claims.
- Log and alert on tool-to-tool or tool-to-external-endpoint data flows that occur without a corresponding user confirmation event.
Known benign look-alikes
- Tools with legitimate automated pipelines that document their data flow transparently
- CI/CD pipeline documentation tools that describe automated data flow stages using similar forwarding language but are part of a transparent, pre-approved deployment workflow