Tool injection occurs when an attacker causes an AI system or intermediary to invoke tools the legitimate user did not intend. In agentic environments this can turn a compromise in the control layer into unauthorized actions in downstream services.
Expanded Definition
Tool injection is an attack pattern in which an AI system, agent, or intermediary is manipulated into calling tools, services, or functions that the legitimate user never intended. In agentic AI, the risk is not limited to bad prompts. The real issue is that a model with execution authority can convert a text input into side effects across downstream systems, including ticketing, cloud APIs, data stores, and notification channels.
Definitions vary across vendors because some teams use the term only for direct prompt-driven misuse, while others include indirect content injection through retrieved documents, web pages, emails, or tool outputs. NHI Management Group treats tool injection as a control-layer compromise: the attacker influences decisioning, then leverages the agent’s privileges to act. That makes it closely related to privilege scoping, tool allowlisting, approval workflows, and separation between inference and execution. The NIST Cybersecurity Framework 2.0 is useful here because it frames the need to govern identity, access, and response around real operational risk rather than model behavior alone.
The most common misapplication is treating tool injection as a prompt-quality problem, which occurs when teams harden text filters but leave tool permissions, execution thresholds, and downstream authorization unchanged.
Examples and Use Cases
Implementing controls against tool injection rigorously often introduces latency and workflow friction, requiring organisations to weigh agent autonomy against the cost of review, segmentation, and exception handling.
- An email-based agent summarizes a message that contains hidden instructions, then uses its calendar or ticketing tool to create actions the sender never authorized.
- A customer-support assistant reads a knowledge-base page with embedded malicious instructions and then invokes a CRM update tool to expose or alter case data.
- A coding agent ingests untrusted repository content and is steered into calling package, build, or deployment tools in ways that change release state.
- A procurement agent receives a document that manipulates its workflow and triggers an approval or purchase action outside the intended user request boundary.
- An NHI-managed service account with broad tool access lets a compromised agent chain actions across systems after a single poisoned input is processed.
These scenarios overlap with the broader NHI exposure problem documented in Ultimate Guide to NHIs, where service accounts and API keys often carry excess privilege. They also align with emerging guidance in the NIST Cybersecurity Framework 2.0 on access control and resilience.
Why It Matters in NHI Security
Tool injection matters because the exploited asset is often not the model itself, but the NHI behind the toolchain: API keys, service accounts, delegated tokens, and automation credentials. Once those identities can execute actions on behalf of the agent, a single successful injection can become unauthorized access, data modification, or lateral movement. This is why tool injection should be evaluated as an NHI governance issue, not only an AI safety issue.
The operational stakes are high. NHI Management Group reports that Ultimate Guide to NHIs found 97% of NHIs carry excessive privileges, which magnifies the blast radius when an agent is tricked into using them. The right response is to bind tools to narrowly scoped identities, require step-up approval for high-risk actions, log every agentic invocation, and isolate untrusted content from executable workflows. This also complements the access governance expectations reflected in the NIST Cybersecurity Framework 2.0.
Organisations typically encounter tool injection only after an agent has already created, changed, or disclosed something it should not have touched, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A2 | Tool misuse and untrusted instruction handling are core agentic AI attack patterns. |
| OWASP Non-Human Identity Top 10 | NHI-02 | Tool injection often abuses overprivileged non-human identities and exposed secrets. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access control is essential when agents can call downstream tools. |
| NIST Zero Trust (SP 800-207) | PA | Zero Trust requires explicit verification before tool actions are trusted or executed. |
| NIST AI RMF | Tool injection is a risk that emerges from unsafe AI system design and misuse. |
Assess tool-enabled agent workflows for misuse, monitor harm, and add human oversight where needed.
