PIP-011
Connector and tool-description poisoning
The description of a tool, rather than its output, carries the instruction, so the attack lands before the tool is ever called.
How it works
An agent is told what tools it has using natural-language descriptions supplied by whoever provides them. Those descriptions sit in the context as instructions. A connector whose tool description contains directives can influence the agent's behaviour towards other tools entirely, without being invoked.
Why it works
Tool registration is trusted implicitly. The text describing a capability is treated as configuration, but it arrives from a third party and reaches the model as prose.
What it looks like
A tool description containing guidance about how the agent should behave generally, or instructions concerning the use of other tools, rather than a plain statement of what this tool does.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Review connector definitions before installation
Architectural
Read the tool descriptions a connector registers, not just its stated purpose. Treat installation with the same scrutiny as any privileged integration.
Inventory connectors as integrations
Architectural
Connectors are privileged system-to-system integrations that teams install themselves. Bring them into the existing integration inventory and third-party review process.
Pin and monitor connector versions
Raises cost
A description that was benign at review can change at any update. Pin versions and re-review on change rather than trusting the initial assessment indefinitely.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- LLM06:2025 · OWASP LLM Top 10
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.