# Tool Knowledge Hijack — Identity Injection with Tool Call Arguments

- **Severity:** Critical
- **Signature ID:** `bf6e860f-1628-4f6c-a6e3-f9cc342de234`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI04 (Memory and Context Poisoning), LLM01 (Prompt Injection)

## Summary

This detects a prompt injection trick where content fed to an AI agent falsely claims to come from a trusted user and also hands the agent exact arguments for a sensitive tool call, like sending money or deleting files. The goal is to get the agent to execute the privileged action without questioning it.

## How the attack works

An attacker plants text somewhere the agent will read it, such as a document, email, or webpage the agent processes as part of its task. That text impersonates a named legitimate user, claiming authority to request an action. It then supplies the exact arguments needed for a privileged tool call, for example a recipient and amount for send_money, or a target path for delete_files. Because the injected content looks like an authoritative instruction with ready-to-use parameters, the agent may execute the call directly instead of treating it as untrusted input.

## Why it matters

An organization can lose money, data, or system control if the agent carries out the injected tool call, since the attack targets high-privilege actions like financial transfers, file deletion, or privilege escalation.

## What you can do

- Require agents to treat any identity claims found inside documents, emails, or web content as untrusted, never as authenticated instructions.
- Add a hard confirmation step for privileged tool calls (money movement, deletion, privilege changes) that cannot be satisfied by content embedded in agent input.
- Separate the channel used for user authentication from the channel used for task content, so impersonation inside a document cannot substitute for real identity verification.
- Review agent logs for tool calls whose arguments originated from ingested content rather than from the verified user session.

## Known benign look-alikes

- Legitimate tool documentation with example argument structures
- Agent framework tutorials showing how to call tools with specific arguments

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00715

---
Source: https://www.netzilo.com/threats/atr-tool-knowledge-hijack-identity-injection-with-tool-call-argu