tool-integrated-llm-agents-where-attack-works-adding-attacker-controlled-tools CLM-0497For tool-integrated LLM agents where the attack works by adding attacker-controlled tools, overwriting the agent's visible toolset with the saved user toolset immediately before planning drives attack success to near zero across direct and indirect injection, memory poisoning and backdoor attacks, but its effect on benign task success is model-dependent — raising it for 7-9B open models and lowering it for GPT-3.5/GPT-4.
Capability: Following instructions hidden in data
Observed on
ASB benchmark, 10 agent domains; attacks that operate by injecting or tampering with tools; requires white-box access to restore a trusted toolset before planning; not tested in dy.
Sources
- Validated by: Attack success rate and original task success rate on the ASB benchmark across four open 7-9B models and GPT-3.5/GPT-4/GPT-5, against no defense and against ASB's paraphrasing and delimiter defenses; ASR fell to 0 on several models under IPI, MP and backdoor, while OTSR fell for GPT models under IPI/MP/backdoor.. Measured on one benchmark (ASB) with four attack families and seven models; [truncated]
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- For open-source LLM agents driving a ROS robot, having the model emit a pseudo-code tool-call plan up front, storing it in a persistent scratchpad, and then restricting each tool invocation to the plan's next step raises task success most on the longest multi-step tasks and for the smaller open models (GPT-OSS-20B on the hardest task rose from 35% with a persistent plan alone to 55% with the constraint), while a strong proprietary model gains little.Completing tasks that take many steps or many hours · reviewed by AI
- For LLM agents on long-horizon web penetration testing, holding the backbone model fixed and moving global state out of the context window onto a persistent graph of verified facts and fact-conditioned intent edges raises task success most on the hardest tasks, where success depends on facts obtained dozens of steps earlier (88.2% overall and 75.0% hard, vs 44.1% and 25.0% for the strongest shared-plain-text-memory baseline).Completing tasks that take many steps or many hours · reviewed by AI
- For tool-using LLM trading agents with a frozen backbone, periodically rewriting the system prompt from the agent's own decision traces and realized portfolio returns changes tool-use behavior reliably — code-interpreter calls rise from about 1 to 2.6-4.5 per day and regime-relevant metrics (VaR, EMA, RSI, signal normalization) that the fixed-prompt agent never computes start appearing — but the resulting risk-adjusted performance beats the fixed-policy agent in only about half the evaluated model-by-regime settings (best Sharpe and cumulative return among LLM methods in 3 of 6).Improving its own scaffolding from failures · reviewed by AI
- For LLM agents that must compose and then execute domain tool workflows, training separate adapters for the two roles splits the gains cleanly: supervised fine-tuning of the planner on reference tool sequences mainly improves workflow-order fidelity, while node-level RL on argument-match rewards mainly improves tool-argument grounding and final-answer quality, and combining both beats either on a 9B backbone.Planning a sequence of actions before acting · reviewed by AI
- For locally deployed open-weight models driving a stateful, dependency-ordered MCP tool server, cutting tool descriptions from full specifications (purpose, parameter semantics, constraints, failure conditions) down to one sentence each raises the fraction of calls the server rejects for every model tested, while its effect on task coverage is less consistent.Using the tools it is given · reviewed by AI
Notes
Drafted from the paper by a model and filed unreviewed. Visible here so it can be read, not because anyone has vouched for it: it does not move any technique's standing and does not count toward the internal scorecard. Drafted confidence: medium. Falsifier as drafted: An attack that manipulates only prompt or memory content while using only legitimate tools, on which toolset restoration leaves attack success unchanged; or a replication where restoration also degrades task success on open models.