Tool Hijacking: When Your Agent's Tools Turn Against You

An attacker doesn't need to control your agent. They just need to control which tool it calls, and how. That's tool hijacking.

Tool hijacking is when an attacker steers your agent into calling a tool in a way that serves the attacker, not you. The agent isn't compromised. It's just been given instructions that make it use its legitimate tools for illegitimate purposes.

The classic example: an agent with access to a file-deletion tool gets told, through a poisoned document, to delete a specific set of files. The agent has the tool, the tool is legitimate, and the action looks like something the agent might legitimately do. The only problem is the instruction came from an attacker.

The defense is authority, not intent. You can't tell the agent 'only delete files when you really mean it.' You have to make the tool call itself verify its authority: does the content that triggered this call have the right to trigger it? High-risk tools need explicit, action-scoped authorization.

Tool hijacking is one of the hardest attacks to spot because the action looks normal. The only reliable defense is enforcing authority at the tool boundary, so a tool can't be triggered by content that has no right to trigger it.