Tool Knowledge Hijack — Identity Injection with Tool Call Arguments

How the attack works

An attacker plants text somewhere the agent will read it, such as a document, email, or webpage the agent processes as part of its task. That text impersonates a named legitimate user, claiming authority to request an action. It then supplies the exact arguments needed for a privileged tool call, for example a recipient and amount for send_money, or a target path for delete_files. Because the injected content looks like an authoritative instruction with ready-to-use parameters, the agent may execute the call directly instead of treating it as untrusted input.

Netzilo detection

Why it matters

An organization can lose money, data, or system control if the agent carries out the injected tool call, since the attack targets high-privilege actions like financial transfers, file deletion, or privilege escalation.

What you can do

• →Require agents to treat any identity claims found inside documents, emails, or web content as untrusted, never as authenticated instructions.
• →Add a hard confirmation step for privileged tool calls (money movement, deletion, privilege changes) that cannot be satisfied by content embedded in agent input.
• →Separate the channel used for user authentication from the channel used for task content, so impersonation inside a document cannot substitute for real identity verification.
• →Review agent logs for tool calls whose arguments originated from ingested content rather than from the verified user session.

Known benign look-alikes

• Legitimate tool documentation with example argument structures
• Agent framework tutorials showing how to call tools with specific arguments

References

• https://agentthreatrule.org/en/rules/ATR-2026-00715

Related threats