Summary: Nine PITAX techniques that attack the agent’s tool layer rather than the model — the tool’s description, its arguments, its results, its selection, or the config files the agent trusts. Most are indirect: the attacker never speaks to the model.
Sources: raw/AI-attack-techniques/PIT-T-42,43,45,46,47,53,65,69,70-*.md
Last updated: 2026-07-29
Tool use gives an agent an attack surface with four distinct planes. PITAX has a separate technique for each, and the distinctions are load-bearing.
The four planes of a tool call
| Plane | Technique | What is weaponised |
|---|---|---|
| The spec | T42 Tool-Definition Injection | instructions hidden in the tool’s description/schema metadata |
| The choice | T65 Tool-Preference Manipulation | name/description optimised to win the agent’s selection, no payload at all |
| The arguments | T70 Function-Call Parameter Smuggling | payloads in the JSON fields the model fills in |
| The result | T53 Tool-Call Spoofing | forged tool output the agent believes came from a real call |
T70 is explicit that it is “distinct from Tool-Definition Injection (the tool’s description) and Tool-Call Spoofing (forged results); this weaponizes the call’s arguments” (source: PIT-T-70-function-call-parameter-smuggling.md). A defence that sanitises tool descriptions covers exactly one of these four.
Line jumping — the payload that lands before approval
T42’s most important variant is “line jumping”, where “the payload lands at tools/list time, before any tool is approved or invoked” (source: PIT-T-42-tool-definition-injection-mcp-tool-poisoning.md; credited to Trail of Bits, with the Tool Poisoning Attack itself credited to Invariant Labs).
This breaks the mental model that a human-in-the-loop tool approval gate is a security boundary. The agent has already ingested the adversarial text by the time the approval prompt renders.
Rug pull — TOCTOU on the agent’s trust state
T43 is the follow-on: “A tool presents a benign definition at approval time, then silently mutates its description or behavior after the user has trusted it, a time-of-check-to-time-of-use attack on the agent’s trust state” (source: PIT-T-43-tool-rug-pull-toctou-mutation.md).
Together T42 and T43 mean tool definitions must be pinned and re-verified, not approved once. Approval is not a durable property of a tool that can change under you.
Tool squatting biases the choice function
T65 is the subtlest of the set because it contains no injected instruction to detect: it optimises “a tool’s name, description, or schema metadata for the agent’s relevance and preference signals so it preferentially selects the attacker’s tool over equally-capable legitimate ones, without hiding any executable instruction. It biases the choice function, not the content” (source: PIT-T-65-tool-preference-manipulation-tool-squatting.md; cites ToolTweak arXiv 2510.02554, ToolHijacker NDSS 2026 / arXiv 2504.19793, ToolCommander).
Content-scanning defences are structurally blind to this. There is nothing malicious in the string.
Confused deputy — the credentials are legitimate
T47 covers “manipulating a higher-privilege agent or tool into performing a sensitive action on the attacker’s behalf, because the trusted component implicitly trusts inbound natural-language requests. The legitimate credentials execute the attacker’s intent” (source: PIT-T-47-confused-deputy-agent-authority-confusion.md).
This is the classic confused deputy problem re-instantiated with natural language as the IPC mechanism. Nothing in the audit log looks anomalous — a trusted component used its own credentials for an action it was designed to perform.
Compliance momentum — agents don’t re-check policy mid-loop
T69 prepends “a harmless, unrelated sub-task ahead of an injected malicious instruction so a tool-using (ReAct-style) agent builds compliance momentum across its action loop and carries straight through into the harmful tool action, since agents rarely re-evaluate policy between steps” (source: PIT-T-69-agentic-compliance-momentum-foot-in-the-door.md; Nakash et al., arXiv 2410.16950).
The stated mechanism — agents rarely re-evaluate policy between steps — is the actual finding. Per-turn safety evaluation is not per-action safety evaluation.
Instruction-file backdoors
T46 hides instructions “often via invisible Unicode, in repository configuration the coding agent automatically trusts (CLAUDE.md, .cursor/rules, copilot-instructions, README) or in a dependency, steering AI coding agents to emit backdoored or vulnerable code” (source: PIT-T-46-agent-instruction-file-injection-rules-file-backdoor.md; Rules File Backdoor, Pillar Security).
Worth noting against this vault: this wiki’s own CLAUDE.md is exactly the file class T46 targets.
T46 is one half of a pincer on coding assistants — it poisons what the agent is told, while slopsquatting poisons what it recommends. See Secure Coding Patterns.
Worms
T45 Prompt Worm self-replicates “into every agent, memory, or RAG store it touches and propagates worm-like across an agent ecosystem” (source: PIT-T-45-prompt-worm-self-replication.md; Morris II / Cohen et al. arXiv 2403.02817, Prompt Infection arXiv 2410.07283, Agent Smith arXiv 2402.08567). Covered further in retrieval-and-memory-poisoning.
Regulatory hook
The GPAI Code of Practice names “tool use and control of physical systems” and “autonomy, self-replication, or planning” as sources of systemic risk, and requires sandboxing and code execution isolation to prevent self-exfiltration by models (source: raw/Laws/Overview of the Code of Practice...md). See Code of Practice security mitigations.