Tool Registry Description Tampering with Embedded Instructions
An attacker edits the text description of a tool in an AI agent's tool registry so that it reads like an instruction to the AI model, not documentation for a human. Because AI agents often treat tool descriptions as trusted context, this can trick the model into calling the tool with attacker-chosen arguments or skipping intended safety steps.
How the attack works
An attacker with write access to the tool registry (or a compromised update pipeline) modifies a tool's name, description, or input schema. Instead of normal documentation prose, the description now contains imperative language aimed at the model, such as instructions to always pass a certain value or to call the tool without confirmation. The underlying executable code of the tool is left unchanged, so code-focused security reviews miss it. When the agent later reads the tool registry, it follows the embedded instructions as if they were legitimate guidance, letting the attacker steer tool invocation and arguments. A schema change made without a matching version bump is a strong sign this happened without proper authorization.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- 20812cdc-0a02-53f1-aabb-0aba1857547d
- Severity
- High
Why it matters
An attacker can manipulate an AI agent into calling tools with parameters the attacker chooses, or into bypassing intended approval and workflow steps, without ever touching the tool's actual code — undermining trust in the whole agent's decision-making.
What you can do
- →Restrict write access to the tool registry to a small, audited set of accounts or automated pipelines.
- →Require a version bump for every change to a tool's name, description, or input schema, and reject changes that lack one.
- →Review description fields for imperative, model-directed language (e.g. "always do X", "never ask before Y") rather than plain usage documentation.
- →Diff and log tool registry entries at registration or reload time so unauthorized changes are visible before they reach a live agent session.
Known benign look-alikes
- Internal developer tooling that writes conversational examples or usage notes inline within description fields during legitimate development
- Auto-generated OpenAPI-to-MCP converters that embed usage guidance strings in description fields without version metadata