Parameter Injection via Tool Arguments
An AI agent can be tricked into passing attacker-crafted text into the arguments it sends to a connected tool or backend service. If that text contains shell commands, SQL, path traversal sequences, or template syntax, and the tool does not sanitize it, the attacker can run commands, read data, or escalate privileges on the system behind the tool.
How the attack works
An attacker gets malicious content into the agent's context, either directly or through a document, webpage, or file the agent reads. The agent extracts this content and includes it as an argument when calling a tool, for example a value passed to a shell, database query, or file-path parameter. The tool's backend processes that argument without properly validating or escaping it. This differs from prompt injection: the target is not the language model's reasoning but the code that runs on the tool server once the argument arrives.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a0559bdb-96c9-4026-b00c-c3f55df0b252
- Severity
- Critical
Why it matters
Successful exploitation can let an attacker run arbitrary commands, extract or corrupt data, or gain elevated access on whatever system hosts the tool the agent calls.
What you can do
- →Validate and sanitize every tool argument on the server side, never trust the AI agent to have already cleaned it.
- →Use parameterized queries, safe subprocess APIs, and allow-lists for paths and filenames instead of building commands or queries from raw strings.
- →Run tool backends with the least privilege needed and isolate them from sensitive systems and credentials.
- →Log and review tool call arguments for shell metacharacters, SQL syntax, path traversal patterns, or template injection markers, while accounting for legitimate tools (code generators, template engines, security scanners) that produce this syntax normally.
Known benign look-alikes
- Code generation tools where SQL or shell syntax is the expected output
- Template engines where template syntax in arguments is legitimate
- Security scanning tools testing for injection vulnerabilities