Unauthorized Tool Call Detection
AI agents call tools (functions, APIs, file operations) using parameters that come partly from user input or model output. Attackers exploit this by stuffing malicious payloads into those parameters — the same tricks used against web apps and shells, just delivered through an agent's tool-calling interface instead.
How the attack works
An attacker interacts with an AI agent and crafts input that ends up as an argument to a tool call, rather than attacking the tool name itself. That argument may contain shell metacharacters, path traversal sequences, SQL or LDAP injection strings, template injection payloads, or attempts to extract environment variables or abuse file operations. Some attempts also probe which tools exist and what privileges they carry, or try to escalate privileges by manipulating parameter values. Because tool names can be renamed or aliased, the attack signal that stays consistent is the structure of the malicious content inside the parameters, not which tool was called.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 5b8da843-d185-45d1-88b7-f331b1a534a1
- Severity
- High
Why it matters
If the underlying tool executes the tainted parameter (running a shell command, querying a database, reading a file path), the attacker can read or modify data, escalate privileges, or pivot into systems the agent has access to — well beyond what the conversation with the agent should allow.
What you can do
- →Validate and sanitize all tool call parameters server-side, independent of what the model produced, before execution.
- →Apply strict allowlists for file paths, shell arguments, and query parameters passed to tools.
- →Restrict each tool's effective privileges to the minimum needed, so a manipulated parameter can't reach sensitive operations.
- →Log tool call arguments and review dynamic tool registration or discovery events, distinguishing legitimate startup behavior from runtime enumeration attempts.
Known benign look-alikes
- Agent frameworks that dynamically register tools during runtime
- Legitimate tool discovery during agent initialization phase
- Agents with broad tool access for administrative purposes
- Development/testing environments with intentionally permissive tool access
- SQL query tools receiving legitimate query parameters