PIP-010
Tool result injection
An agent calls a tool, and the text that comes back carries instructions the agent then follows.
How it works
Tool output is appended to the agent's context as ordinary text, in the same format as its instructions. Anyone who can influence what a tool returns can therefore write into the agent's context, and the agent acts with its own credentials at machine speed.
Why it works
The observe step of an agent loop has no channel separation. A result and an instruction are the same kind of thing once appended.
What it looks like
Instruction text inside a record the agent will read: a ticket body, a database field, a file the agent opens, a response from an external service.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Scope the agent's tools to the task
Architectural
The question is not whether an agent can be misled, because it can. The question is what it holds when that happens. An agent with a bulk export and an unrestricted send is a breach waiting for the right record; the same agent scoped to its task is an inconvenience.
Confirm irreversible actions with a person
Architectural
Sending, paying, deleting and publishing cannot be undone. Requiring human confirmation on exactly those steps contains the outcome without hobbling the agent.
Log every tool call
Raises cost
An agent is a service account. Record what it called and with which arguments, and alert on unfamiliar destinations.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- LLM06:2025 · OWASP LLM Top 10
- AML.T0051.001 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-08-03.