Tool poisoning

Manipulating tool metadata or returned content so a model receives attacker-controlled instructions through a connected tool.

Models use names, descriptions, schemas, annotations, and tool results to decide what to call and how to interpret the response. A compromised or malicious server can place instructions in those fields and attempt to redirect later actions or data access. Success depends on the model and surrounding controls; tool metadata does not have to outrank system instructions to influence a probabilistic decision.

Builder example

Connected tools add both software supply-chain risk and an indirect prompt-injection channel. Trusting the server package is not enough if its metadata can change after approval or if its result can request unrelated actions. Application permissions and destination limits should remain enforceable when the model follows poisoned text.

Common confusion: Tool poisoning is not limited to invisible text or to one protocol. The relevant property is attacker influence over model-readable tool definitions or results.