PIP-011
Connector and tool-description poisoning
The description of a tool, rather than its output, carries the instruction, so the attack lands before the tool is ever called.
How it works
An agent is told what tools it has using natural-language descriptions supplied by whoever provides them. Those descriptions sit in the context as instructions. A connector whose tool description contains directives can influence the agent's behaviour towards other tools entirely, without being invoked.
Why it works
Tool registration is trusted implicitly. The text describing a capability is treated as configuration, but it arrives from a third party and reaches the model as prose.
What it looks like
A tool description containing guidance about how the agent should behave generally, or instructions concerning the use of other tools, rather than a plain statement of what this tool does.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Review connector definitions before installation
ArchitecturalWorks on: control sources, integrations and assumptions
Read the tool descriptions a connector registers, not just its stated purpose. Treat installation with the same scrutiny as any privileged integration.
Inventory connectors as integrations
ArchitecturalWorks on: control sources, integrations and assumptions
Connectors are privileged system-to-system integrations that teams install themselves. Bring them into the existing integration inventory and third-party review process.
Pin and monitor connector versions
Raises costWorks on: control sources, integrations and assumptions
A description that was benign at review can change at any update. Pin versions and re-review on change rather than trusting the initial assessment indefinitely.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- LLM06:2025 · OWASP LLM Top 10
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-10-08.
Others in agentic and tool abuse
Not sure whether this applies to what you run? Tick what your system reads and does and the library lists the patterns that apply, with the defences to start with.