Agentic ShadowLogic exposes a hidden tool-call hijack risk

At a glance

What this is: This research shows how a graph-level backdoor can silently rewrite agentic tool calls, causing a model to execute attacker-proxied URLs while displaying normal conversational output.

Why it matters: IAM, PAM, and AI governance teams need to treat tool-call integrity as part of identity and access control because agentic systems can be manipulated between intent and execution.

Context

Agentic AI systems do more than generate text. They decide when to call tools, what data to request, and how to package those requests for downstream systems, which makes tool-call integrity a governance issue rather than a pure model quality issue.

In this research, HiddenLayer describes a backdoor embedded in the model graph that intercepts URL generation inside tool calls and rewrites the destination at runtime. The user still sees a normal response, but the executed request can be routed through attacker-controlled infrastructure.

That gap between displayed intent and executed action is the core problem for identity governance in agentic systems. It is not enough to trust the conversational layer if the action layer can be altered after the model has formed its request.

Key questions

Q: What breaks when an agentic model can rewrite tool calls at the graph level?

A: The trust model breaks because the system that appears to decide the action is no longer the system that executes it. A graph-level backdoor can alter structured tool arguments after intent formation, so user review of the response no longer proves the request that actually left the model. That makes action integrity a separate control problem.

Q: Why does hidden tool-call manipulation create a higher governance risk than prompt injection alone?

A: Because prompt injection changes what the model may say, while tool-call hijacking changes what the system may do. When the action path is rewritten inside the model graph, downstream requests, URLs, and potentially embedded credentials can be intercepted even if the response looks normal. The operational risk is execution-level compromise, not just misleading text.

Q: How can security teams verify that an agentic system executed the request it appeared to make?

A: They need telemetry on the structured tool call and the downstream network transaction, then compare both against the user-visible response. If the URL, headers, or destination differ from the model’s displayed intent, the action layer cannot be trusted. Verification has to cover the full request path, not only the model output.

Q: Should teams allow tool-calling models from public repositories into production unchanged?

A: No. If a model can call tools, the repository artifact itself becomes part of the trust boundary, and a hidden graph-level payload can survive until a trigger condition appears. Teams should require provenance review, graph inspection, and approval before production use, especially where tool calls can reach external services or credentials.

Technical breakdown

How graph-level tool-call hijacking works

The attack targets the model’s computational graph rather than the prompt or the tool itself. In the example, the backdoor watches for URL generation inside a block, identifies the :// token, and then swaps the intended destination for a proxy URL. Because the modification happens inside the generation path, the conversational output remains unchanged while the structured tool call is altered. That makes the model appear trustworthy even when the executed request is not. The result is a man-in-the-middle position inserted between the agent and the real tool endpoint.

Practical implication: Practitioners need to inspect model graphs and tool-call behavior, not just prompts and outputs, before allowing production tool access.

Why KV cache state makes the backdoor persistent

The demonstration uses KV cache positions to store attack state across token generations. That allows the backdoor to remember whether it is inside a tool call, whether hijacking is active, and which injected token comes next. The important detail is that the malicious logic does not need external coordination once the model is running. It carries state inside the inference flow, so ordinary prompt filters and response checks do not see the entire attack path. This is a runtime control problem hidden inside model execution, not a one-shot prompt injection.

Practical implication: Security teams should treat runtime state inside agentic inference as part of the attack surface and not assume stateless request handling.

Why the visible answer can stay clean while the action changes

The core stealth property is the split between the conversation layer and the action layer. The model can produce a reassuring natural-language answer while the tool call argument is silently rewritten underneath it. That means human review of the response is not enough to prove the tool action was safe. In agentic systems, this creates a dangerous trust gap because the user validates what the model says, not what the model actually executed. The article shows that the proxy can log traffic, observe destinations, and potentially influence responses without surfacing obvious errors.

Practical implication: Deployments need separate assurance over executed tool arguments, not just the final text the model returns.

Threat narrative

Attacker objective: The attacker wants to intercept, log, and potentially alter agentic tool traffic while keeping the model’s user-facing response unchanged.

1. Entry occurs when a backdoored model file is deployed, so the malicious logic arrives with the model rather than through a prompt.
2. Credential access and interception begin when the model generates a tool-call URL and the graph-level backdoor rewrites that destination to attacker infrastructure.
3. Escalation happens as the proxy sits between the agent and the intended endpoint, allowing request logging and possible response manipulation without changing the user-visible answer.
4. Impact is the silent compromise of tool-mediated workflows, including exposure of destinations, parameters, and potentially embedded credentials carried in requests.

Breaches seen in the wild

• Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
• Mastra npm Supply Chain Attack — Sapphire Sleet: North Korean Sapphire Sleet backdoors 144 AI npm packages in 88 minutes via supply chain attack on Mastra ecosystem.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Tool-call integrity is now an identity control, not just a model quality concern. Agentic systems do not merely predict text, they initiate actions through structured requests. Once a model can rewrite those requests at the graph level, the security boundary moves from prompt filtering to execution integrity. Practitioners should treat the tool-call path as governed access, not as passive output.

Visible model output is no longer a sufficient trust signal for agentic systems. This attack exploits the separation between what the user sees and what the system executes, which makes conversational review a weak assurance control. The governance implication is simple: if the action layer is mutable after generation, the response layer cannot certify intent. Security teams need independent verification of executed arguments and destinations.

Model provenance now carries the same trust weight as code provenance. A backdoored model can behave normally until a trigger condition appears, then alter tool use without any obvious operational error. That is a supply-chain problem for agentic identity, because the model file itself becomes the enforcement point for hidden access behavior. The practitioner conclusion is that uninspected public models should be treated as untrusted executables.

Runtime state inside inference creates an inspection gap that traditional prompt defenses cannot close. The technique uses KV cache state and conditional branching to coordinate hijack timing across token generation steps. That means the attack is not just in the input or the output, but in the in-between state that governs action selection. Teams should rethink assurance around the full execution path, not the text interface alone.

Agentic ShadowLogic sharpens a new concept: graph-level tool-call hijack. This is the hidden modification of structured actions inside the model graph after intent is formed but before the tool call is executed. It matters because identity governance for autonomous systems depends on whether the action actually issued is the action that was authorized. Practitioners should anchor controls on that distinction.

What this signals

Graph-level tool-call hijack: agentic systems need assurance over the action layer, not only the prompt and response layer. When a model can silently rewrite a tool destination inside its own inference path, the governance problem shifts from content safety to execution integrity, and that changes how teams should assess production readiness.

For practitioners, the immediate implication is that model provenance and tool-call observability now belong in the same control conversation. A clean answer from the model is not evidence that the executed request was safe, and any workflow that can reach external URLs or credential-bearing endpoints deserves separate verification of the request it actually issued.

For practitioners

• Inspect model graphs before deployment Analyze ONNX and similar model artifacts for conditional branches, suspicious token-routing logic, and stateful structures that alter tool-call arguments at runtime.
• Validate executed tool arguments independently Log and compare the model’s structured tool call against the downstream request actually sent to the endpoint so mismatches are visible during review and incident response.
• Treat public models as untrusted executables Require provenance review, signing, and approval for any model that can issue tool calls, because malicious logic can persist inside the model file itself.
• Separate conversational and action-layer monitoring Monitor the text response, the tool payload, and the network transaction as distinct telemetry streams so a clean answer does not mask a rewritten action.
• Limit tool permissions to narrowly scoped actions Constrain what each agentic workflow may reach, especially external URLs and credential-bearing requests, so a hijacked call has less room to exfiltrate or redirect traffic.

Key takeaways

• Agentic ShadowLogic shows that a model can alter tool-call behavior without changing the user-facing answer, which makes execution integrity the real control boundary.
• The attack is dangerous because the compromised model can proxy, log, and potentially manipulate requests while appearing to behave normally.
• Practitioners need graph inspection, provenance review, and independent verification of structured tool calls before allowing agentic systems into production.

Key terms

• Agentic Tool Call: A structured action request generated by an AI system to invoke an external tool, API, or workflow. In agentic environments, the tool call is the real control point because it carries the executable instruction, not just the model’s natural-language response.
• Graph-level backdoor: A graph-level backdoor is malicious logic embedded in a model’s computational graph rather than in its prompt or surrounding application code. It can trigger on runtime conditions, persist through deployment artefacts, and change behaviour without obvious signs in the user-facing conversation.
• Execution Integrity: Execution integrity is the degree to which an agent’s runtime actions remain valid, authorised, and aligned with the original task. It depends on correct tool schemas, trustworthy intermediate state, and enforcement mechanisms that can block bad actions before they affect external systems.
• Model Provenance: Model provenance is the evidence chain showing where an AI artefact came from, how it was modified, and whether the version in use is the one that was approved. For AI security teams, provenance is the control that turns trust from assumption into verification.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.