Argument smuggling is the use of legitimate tool calls to carry malicious content in values, payloads, or provenance that appear acceptable at the invocation layer. The call itself is allowed, but the data embedded in it changes the security meaning of the action.
What Argument Smuggling Is in Practice
Argument smuggling happens when a system accepts a legitimate tool invocation, but the values inside the call carry hidden or unexpected meaning that changes what the action really does. The danger is not the invocation itself, it is the trusted boundary between the call format and the embedded content.
This pattern matters in tool-using applications because the outer request may look policy-compliant while the inner arguments steer the tool toward unsafe output, unauthorized scope, or misleading provenance. In other words, the control surface is correct, but the payload has been weaponised.
How Argument Smuggling Works
Most smuggling cases exploit a mismatch between what the orchestrator validates and what the downstream tool actually interprets. That mismatch can appear in structured fields, nested JSON, encoded strings, metadata, or provenance-like attributes that are treated as data by one layer and instructions by another.
The result is often a form of semantic drift. A wrapper may approve the call because the method, endpoint, or schema looks legitimate, while the downstream parser, model, or plugin interprets the embedded content in a way that changes the effective action. This is especially dangerous when tool calls are chained, transformed, or partially normalized before execution.
Where It Creates Security Exposure
Argument smuggling can undermine trust boundaries in agent workflows, API-mediated automation, and systems that pass content through multiple interpreters. It can also blur auditability, because logs may record an apparently allowed call while the meaningful risk sits inside a field that is easy to overlook.
It becomes more serious when the smuggled value influences authorization, routing, retrieval scope, prompt context, or downstream tool selection. A safe-looking invocation can then trigger data exposure, privileged actions, policy bypass, or hidden manipulation of the system’s decision path.
What Distinguishes It from Ordinary Injection
Argument smuggling is not just generic injection. The defining feature is that the malicious material hides inside an otherwise valid argument envelope, so the call survives validation at one layer and only becomes harmful when another layer consumes it.
That distinction matters for defenders because the fix is rarely just “sanitize input.” The real problem is interface mismatch: each boundary must agree on what is executable, what is data, and which fields can alter security meaning. NIST Cybersecurity Framework 2.0 is useful here because it frames this as a governance and control issue, not only a parsing problem, and OWASP API Security Top 10 helps describe how an apparently valid request can still produce unauthorized behavior.
Risk and Threat Considerations
Argument smuggling is risky because it lets an attacker preserve the appearance of legitimacy while altering the meaning of an allowed action. That makes it attractive in systems where approvals, filters, or policy checks focus on the outer call rather than the embedded values.
Failure mechanism: A validation layer accepts the invocation, but a downstream interpreter, tool, or model assigns different meaning to one of the arguments, letting the attacker steer behavior through a trusted path.
Impact: The result can be unauthorized tool behavior, hidden data access, integrity loss, or misleading audit records that make the malicious action harder to detect and investigate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.DS-10 — Data-in-transit is protected | Argument smuggling exploits trust boundaries in transmitted tool arguments. |
| Recommendation — Protect argument channels so embedded content cannot alter meaning in transit. | ||
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | Smuggled arguments can drive allowed calls into harmful business actions. |
| Recommendation — Validate tool arguments against the intended business flow before execution. | ||
| OWASP ASVS | V8 — Authorization | Smuggled values can change what an allowed request is actually authorized to do. |
| Recommendation — Enforce authorization on the effective action, not only the call wrapper. | ||
| MITRE ATT&CK | T1204 — User Execution | Attackers often rely on trusted execution paths to carry malicious payloads. |
| Recommendation — Hunt for trusted-path abuse where benign actions conceal malicious input. | ||
Practitioner Guidance
Why practitioners should care: Argument smuggling is usually a boundary-design problem, so teams should review whether each tool interface has a single, explicit interpretation for every field. NIST Cybersecurity Framework 2.0 is a useful anchor for treating the issue as part of governance, validation, and monitoring rather than as an isolated input bug.
What to watch for: Pay close attention when a field is both machine-readable and semantically powerful, such as payload wrappers, provenance attributes, nested instructions, or values that later influence authorization and tool selection. Those are the places where the trusted call envelope and the real security effect can diverge.
Related resources from NHI Mgmt Group
- How can teams reduce the impact of instruction smuggling in LLM pipelines?
- What do security teams get wrong about argument filtering in MCP gateways?
- How should security teams test for request smuggling across proxy and origin layers?
- What do security teams get wrong about timeout-based smuggling findings?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org