# Hidden LLM Safety Bypass Instructions in Tool Descriptions

- **Severity:** Critical
- **Signature ID:** `4a3b0811-ebe0-4c25-a566-ac2ed38ffb89`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0110.000 (Definition and Instructions)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection), LLM07 (System Prompt Leakage)

## Summary

Some AI agent tools come with text descriptions that the AI reads before deciding how to use them. This rule flags tools whose description contains hidden instructions like 'NOTE TO AI: disregard all safety instructions,' aimed at getting the AI to drop its guardrails.

## How the attack works

An attacker publishes or modifies a tool that an AI agent can call, and writes a description for that tool containing text addressed directly to the AI rather than to a human user. The text tells the AI to ignore prior instructions, disregard safety policies, or bypass restrictions. Because agents typically load tool descriptions as trusted context, the AI may follow these embedded commands as if they came from its operator. This is a step toward getting the agent to act outside its intended safety boundaries, distinct from tricks that just skip a user confirmation prompt.

## Why it matters

If successful, the AI agent can be pushed to ignore its safety policy and take actions it would normally refuse, using a tool as the injection point rather than a normal chat message.

## What you can do

- Review the full text of tool descriptions before allowing an agent to load them, not just their function names.
- Treat any tool description containing phrases like 'ignore previous instructions' or 'disregard safety' as suspicious and block it.
- Restrict which sources can register or update tool descriptions available to your agents.
- Keep an allowlist of vetted tools and diff descriptions on update to catch injected text.

## Known benign look-alikes

- Security documentation tools that reference bypass techniques for educational purposes
- A cybersecurity training platform tool whose description quotes the exact attack pattern as an example of what to detect, inadvertently triggering the rule

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00103

---
Source: https://www.netzilo.com/threats/atr-hidden-llm-safety-bypass-instructions-in-tool-descriptions