TL;DR: ToolJack shows that a compromised bridge protocol can let an attacker replace what an AI agent believes it sees, turning local credential theft into real-time perception manipulation, according to Preamble. Model-level alignment still blocked autonomous code execution, but poisoned tool results can still corrupt recommendations, summaries and decision support.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Preamble's research: ToolJack shows how bridge protocol exploitation can replace an AI agent's perceived browser context and manipulate tool outputs.
Why it matters: Identity and access teams need to treat agent perception channels as part of the trust boundary, because corrupted context can distort downstream decisions even when execution is still contained.
Context
ToolJack targets the trust boundary between an AI agent and the tool layer it relies on to understand the browser. The security problem is not simple data theft; it is that the agent can be shown a believable but false environment, which changes what it decides next.
That matters for agentic AI governance because the agent may summarise, recommend or act on information it has never actually observed. Agentic AI identity controls need to extend beyond login and into the integrity of the channel that carries tool results.
Key questions
Q: How do AI agents verify browser context before acting?
A: AI agents should verify browser context by checking provenance, device binding and tool-response integrity before they rely on page content or tab state. Without those checks, a compromised channel can make fabricated tabs and spoofed responses look legitimate, which turns perception into an attack surface rather than a source of truth.
Q: Why does local compromise matter for agentic AI trust?
A: Local compromise matters because an attacker who controls the same device, browser session, or terminal can steal session tokens, intercept prompts, or alter tool calls before the agent acts. If the agent trusts the same session material and tool channel, the attacker can impersonate the human or redirect delegated actions, so device trust, session binding, and step-up reauthentication are critical.
Q: What is the difference between prompt injection and tool poisoning?
A: Prompt injection targets the model's instructions, while tool poisoning targets the metadata the agent uses to reason about tools. Both can alter behaviour, but tool poisoning is especially dangerous when the agent trusts external tool descriptions or schemas. Teams should defend both layers because either one can lead to unauthorized actions.
Q: What should teams log for each AI agent tool call?
A: Teams should log the tool-call identity chain, including call ID, session and parent IDs, actor details, server and tool name, arguments hash, result status, timing, authentication, and policy decision. That gives investigators enough evidence to reconstruct behaviour without depending on chat history, which only shows the conversation and not the executed action.
Technical breakdown
How bridge protocol routing becomes a trust boundary
The bridge sits between the agent and the external tools it queries, so it becomes the place where identity, routing and message integrity meet. If the protocol authenticates the user but not the device, and if tool responses are not cryptographically bound to the originating extension, an attacker with local foothold can impersonate the trusted path. That creates a split between what the human sees and what the agent believes. The mechanism is not model failure first; it is transport and identity failure that the model then consumes as truth. See the Agentic AI Identity Guide.
Practical implication: Bind tool responses to device and extension identity, not just account identity.
Why fabricated browser tabs are more than spoofed content
A fabricated tab is not just a fake page title. It is a constructed element inside the agent's working context, which means the agent can be steered by a browser state that never existed for the user. In this attack pattern, the attacker does not need to change the website itself. They only need to win the agent's view of open tabs, page text and source attribution. Once that view is replaced, downstream reasoning is built on invented evidence rather than real session state. See the Agentic AI Security Guide.
Practical implication: Treat browser state exposed to agents as security-sensitive input that must be provenance checked.
Why model alignment stopped escalation but not impact
The research shows a useful distinction between containment and prevention. The attacker could corrupt summaries, recommendations and analysis by feeding the agent false tool output, yet the model still rejected autonomous code execution attempts. That means safety alignment acted as a last line of defense against action, but it did not restore truth to the agent's context. For practitioners, output integrity and action safety are separate problems that need separate controls. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Design controls for both false context and unsafe execution, because blocking commands does not undo poisoned decisions.
Threat narrative
Attacker objective: The objective is to control what the AI agent believes about the environment so that its outputs, decisions and recommendations serve the attacker.
- Entry occurs through a same-user local process that can read application memory and extract session material from the host.
- Credential access then pivots that session material into bridge authentication, creating account-valid access that is not device-bound.
- Escalation follows when the attacker wins bridge routing priority and replaces legitimate tool responses with fabricated data.
- Impact is perception-layer compromise, where the agent produces summaries and recommendations from attacker-controlled context instead of real browser state.
Breaches seen in the wild
- Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Tool-channel integrity is now an identity control, not just an integration detail. ToolJack shows that once the bridge layer can be intercepted, the agent's trust in browser state is no longer anchored to reality. The important control question is no longer only who is logged in, but whether the message path itself preserves provenance. Practitioners should treat tool-result integrity as part of the identity plane.
Agent perception can be compromised without defeating the model. This research separates content poisoning from action safety in a useful way: the attacker distorted what the agent believed, yet model alignment still blocked the final command execution. That means governance teams must stop assuming one safety layer covers both truth and action. The failure mode is corrupted decision support, which can be damaging even when direct execution is prevented.
Delegated access is fragile when user identity is reused across devices. The bridge authenticated the user rather than the device, so a token minted on one system could control browser extensions elsewhere on the same account. That is a classic delegated trust problem that becomes sharper in agentic AI, where the agent consumes the account's context as if it were one continuous workspace. Device binding and session provenance become governance requirements, not convenience features.
Remote Listener Indirect Prompt Injection is a useful named concept for this class of attack. The attacker is not waiting for the victim to stumble into poisoned content; the attacker actively constructs the hostile environment around the agent during execution. That changes red-team and defensive assumptions about prompt injection, because the trap is delivered through a live trusted channel rather than a static lure. Security programmes should model the environment itself as injectable.
Phantom Tab Injection illustrates how agentic systems can be deceived at the boundary of perception. The attacker does not need to alter every source the agent reads; replacing the tabs the agent thinks are open is enough to redirect the entire reasoning chain. That is a perception-layer analogue to data poisoning, and it should change how teams think about evidence integrity in agentic workflows. The practical conclusion is that browser-state trust needs explicit verification.
From our research library:
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Tool-result provenance will become a first-class control for agentic systems. When an agent can be fed fabricated tab state and synthetic page content through a trusted channel, the security problem is no longer limited to prompt injection. The control plane has to record where each item of context came from, or the agent will continue to treat attacker-controlled evidence as ordinary input.
Remote Listener Indirect Prompt Injection is the right way to think about live, attacker-driven environment construction around an agent. Static poisoned pages are no longer the whole story, because the attacker can manipulate the environment mid-session and keep the agent inside a false reality. Governance teams should prepare for attacks that aim to corrupt decision support rather than trigger an obvious exploit.
The wider market signal is that 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028, according to the 2026 Infrastructure Identity Survey. That growth makes perception integrity, device binding and provenance logging operational requirements, not advanced controls.
For practitioners
- Harden bridge authentication to the device Require cryptographic binding between the session token, the originating device and the extension instance so a token minted on one host cannot control another host's browser context.
- Validate tool-result provenance end to end Log and verify which extension, process and device produced each browser tool response before the agent consumes it as context.
- Separate browser context from trusted evidence Flag any agent-visible tab, page excerpt or source label that cannot be independently corroborated against the user's actual session state.
- Review agent approvals for within-session drift Check whether an agent can be shown one reality at the start of a task and a different reality later in the same session without a new consent event.
Key takeaways
- ToolJack shows that compromising the channel between an AI agent and its tools can be enough to distort the agent's view of reality.
- The research separates two outcomes: the attacker could corrupt context and recommendations, but model alignment still blocked autonomous code execution.
- Device-bound authentication, tool provenance and browser-state verification are the controls that matter most when the evidence stream itself can be manipulated.
Related NHI Mgmt Group resources: AI Agents vs Agentic AI · Agentic AI Identity Guide · Agentic AI Security Guide · AI Agent Observability, Audit and Incident Response Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI07 — Insecure Inter-Agent Communication | ToolJack exploits a trusted communication channel between the agent and its tools, making message integrity central. |
| ASI03 — Identity & Privilege Abuse | The attack abuses account-valid access and routing trust to act as a different trusted source inside the session. | |
| Recommendation — Treat agent-tool channels as security boundaries and verify provenance for every exchanged message. Constrain agent privileges to the minimum session scope and bind them to device-specific identity. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The bridge authenticates the user but not the device, allowing cross-device reuse of stolen session material. |
| NHI-05 — Overprivileged NHI | Once the attacker owns the trust channel, the agent inherits broader effective access than intended. | |
| Recommendation — Bind non-human sessions to the device and application instance that created them. Reduce the effective reach of agent sessions so compromised context cannot span the whole account. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The attack begins with session theft and then pivots across devices through account-valid access. |
| Recommendation — Map stolen session material to credential access and hunt for cross-device pivot activity. | ||
Key terms
- Bridge Protocol: Bridge Protocol is a communication pattern or protocol layer that connects an AI agent to external tools, systems, or contexts. It defines how requests, responses, and permissions are passed between components, usually so the agent can use tool functions without holding broad direct access to each backend system.
- Session Token: A session token is a short-lived credential that proves a user, service, or agent has already been authenticated. In IAM, it is used to maintain access without re-entering credentials, and must be protected because theft can let an attacker reuse the active session until expiration or revocation.
- ToolJack: A bridge-protocol attack pattern that lets an adversary manipulate what an AI agent believes it sees by intercepting tool communication. It is not a model jailbreak. It is a perception-layer compromise where the agent consumes fabricated browser state and tool outputs as if they were trusted evidence.
- Tool Relay Spoofing: Tool Relay Spoofing is an attack in which a malicious party imitates a legitimate tool relay or intermediary so an AI agent sends commands, data, or credentials to the wrong destination. The spoofed relay can change tool outputs, capture secrets, or make unauthorised actions look approved.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.
Published by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org