Threat dossier · P2
Tool-result injection
The malicious content arrives mid-execution, after a tool has already been trusted, and can redirect subsequent tool calls.
Direct answer
What is tool-result injection?
Tool-result injection occurs when an API, MCP server, command output, retrieved document, or other tool response contains hostile instructions that the agent treats as trusted guidance.
Coverage statements below are limited to the current HOL Guard support contract and do not imply universal model or harness protection.
Representative attack path
Defensive model only. This sequence omits weaponized payloads and is not attributed to a specific incident unless a source explicitly says so.
Step 1
Agent calls a tool or retrieval source.
Step 2
Returned content contains hostile instructions.
Step 3
Agent interprets result text as policy or next-step authority.
Step 4
A second sensitive action is requested.
Coverage boundary
What this control can cover
- Guard-visible follow-on actions remain eligible for runtime policy even if the tool result already influenced reasoning.
- Supported MCP/tool configuration can be separately reviewed.
What it does not prove or prevent
- Universal sanitization of arbitrary tool output.
- Guarantee that the model will distinguish data from instructions.
Policy pattern
Policy pattern for tool-result injection
Keep untrusted context or overbroad autonomy from becoming unconditional execution authority on supported action surfaces.
Use when: The malicious content arrives mid-execution, after a tool has already been trusted, and can redirect subsequent tool calls.
Decision pattern
- Identify the trust boundary and consequential action class.
- Apply least privilege and the narrowest supported policy.
- Require review for sensitive or ambiguous actions.
- Preserve only redacted, versioned evidence needed to reproduce the decision.
Limitations
- Universal sanitization of arbitrary tool output.
- Guarantee that the model will distinguish data from instructions.
If you suspect prompt injection
Step 1
Response 1
Stop downstream sensitive actions.
Step 2
Response 2
Isolate the response/source that introduced instructions.
Step 3
Response 3
Review the tool/server trust decision.
Step 4
Response 4
Retest with a safe fixture and stricter policy.