# Polymorphic Skill and Capability Aliasing Attack

- **Severity:** High
- **Signature ID:** `8c5e519f-6641-4294-8848-7822078f1457`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects attempts to hide risky capabilities inside an AI agent by giving them innocent-sounding names, or by rewriting a tool's code after it has been reviewed. The goal is to slip a dangerous function past whatever checks look for known-bad tool names or behavior.

## How the attack works

An attacker registers a new tool or function using a name that sounds benign (like 'format_text' instead of 'delete_files'), or overwrites an existing, already-approved tool's definition with new, malicious code. They may also generate tool code dynamically at runtime so its actual behavior only exists in memory and differs from whatever was reviewed earlier. Because the name stays trustworthy while the underlying capability changes, static audits or one-time approval checks miss the swap. The agent then calls the tool believing it does what its name suggests.

## Why it matters

An organization can end up running unreviewed or malicious code through an agent that appears to only use approved, safe-sounding tools, defeating capability allow-lists and code review controls.

## What you can do

- Re-verify tool code and behavior at call time, not just at registration or initial review.
- Restrict who or what can register or redefine tool/function names at runtime.
- Log and diff tool definitions over time to catch silent redefinitions of previously approved capabilities.
- Require naming conventions and code hashes for tools so a name-to-behavior mismatch is detectable.

## Known benign look-alikes

- Legitimate software development discussions about function refactoring
- Developer documentation explaining how to remap keyboard shortcuts for IDE tool commands using configuration files
- Software architecture discussion about lazy loading patterns for plugin capabilities in a modular system
- Front-end bundle-splitting documentation ("lazy load non-critical code", "lazy loading and code splitting", a "Lazy Loading" heading above a typescript fence). Measured on 8 published skills; pattern [4] no longer matches these because deferred loading now requires an attack noun and the noun group is word-bounded.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00089

---
Source: https://www.netzilo.com/threats/atr-polymorphic-skill-and-capability-aliasing-attack