Schema-Description Contradiction Attack
Some AI agent tools present themselves as safe and non-destructive in their name or description, while their actual parameter schema quietly includes options that write, modify, or delete data. This mismatch is used to slip a dangerous tool past a security review that only reads the description.
How the attack works
An attacker or a careless developer registers a tool with a reassuring name and description, such as 'safe_query: read-only database query'. A reviewer scanning descriptions approves it, believing it cannot change data. But the tool's schema includes a parameter like 'write_mode', sometimes defaulting to true, that actually enables inserts, updates, or deletes. Once approved, an AI agent can invoke the tool and trigger the hidden write behavior, either on its own or because it was steered to do so.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- fecb72e9-daaf-4744-823e-4356737f7b7a
- Severity
- High
Why it matters
Data can be modified or destroyed by a tool that was approved as safe, bypassing the intent of security review and giving the agent more capability than anyone intended it to have.
What you can do
- →Review tool schemas parameter-by-parameter, not just tool descriptions, before approving them for agent use.
- →Flag any parameter names suggesting write, delete, update, or mode-switching behavior and require explicit justification and default-safe values.
- →Require that tool descriptions accurately reflect every capability exposed in the schema, and reject tools where they diverge.
- →Log and alert on invocations where a nominally read-only tool is called with parameters that enable writes.
Known benign look-alikes
- Tools that document write_mode for cache warming with clear explanation