Tool response injection
Also called: tool result injection, tool output poisoning
Prompt injection carried in the data a tool returns, so a legitimate tool call brings attacker-controlled instructions into the model's context.
The tool itself is fine and the call is legitimate — but the data it fetches is not. A search_web result, the body of a retrieved email, the rows of a database query, the contents of a file: any of it can contain "assistant: now do X." The model reads the tool result as part of the conversation and may act on the embedded text.
Why it matters
It means you cannot make an agent safe just by vetting its tools. Every tool that returns externally-influenced data is an injection vector. This is the mechanism behind most real-world agent exploits: the attack rides in on a normal, approved operation.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.