Tool Camouflage — Forced Specific Tool Invocation via Injected Instruction

How the attack works

The agent retrieves or is shown content (a document, web page, tool output, or similar) that contains attacker-written text. That text is formatted to look like a completed answer, e.g. 'Answer: task complete', so it blends in with normal output. Embedded in or right after that fake answer is an instruction forcing the agent to invoke a specific named tool and explicitly barring it from using any other tool. If the agent follows this injected instruction instead of its own judgment, it calls the attacker-chosen tool — which may be fake, mislabeled, or a legitimate but privileged tool being abused for an unintended purpose.

Netzilo detection

Why it matters

An attacker can redirect an agent's tool use toward actions the operator never sanctioned, potentially triggering privileged operations, data exfiltration, or further compromise, while the fake 'task complete' framing makes the manipulation harder for a human reviewer to notice.

What you can do

• →Treat tool names and invocation instructions found inside retrieved content (not from the system prompt or trusted user input) as untrusted data, not commands.
• →Log and review cases where an agent's tool choice was influenced by text embedded in fetched documents or tool outputs, especially when it excludes other tools.
• →Restrict which tools an agent can call based on the current task context, rather than letting arbitrary content dictate tool selection.
• →Add checks that flag content mimicking a completed-task format ('Answer: ...') paired with directive language about tool usage.

Known benign look-alikes

• Legitimate tool documentation specifying which tool to use for a given operation
• Workflow definitions that explicitly name the required tool for each step

References

• https://agentthreatrule.org/en/rules/ATR-2026-00714

Related threats