Tool Description Injection is a prompt injection technique that targets an AI agent or tool-using system through the natural-language descriptions of available tools. Malicious instructions hidden in those descriptions can influence tool selection, argument construction, or data handling when the model trusts tool metadata too much.
What tool description injection is
Tool description injection is a form of prompt injection that abuses the natural-language metadata attached to tools. Instead of attacking the model directly, it hides instructions in the text the model uses to decide which tool to call and how to use it.
That makes the attack subtle: the tool description can look like ordinary documentation, yet still steer selection, parameter values, output handling, or follow-on reasoning. The core failure is over-trusting untrusted metadata that should be treated as data, not instructions.
How the attack works in tool-using systems
Many agentic and assistant systems expose tools through catalogs, schemas, or descriptions that the model reads at runtime. If those descriptions are sourced from third parties, dynamically generated, or not tightly governed, an attacker can plant hidden directives that the model may obey during planning or execution.
The risk rises when the tool layer is integrated into a broader workflow with retrieval, memory, or automatic tool chaining. A malicious description can bias the model toward a dangerous tool, a wrong argument set, or an unsafe interpretation of returned data, especially when the orchestration layer does not separate policy from prompt content.
This is why prompt-injection guidance that covers tool poisoning and description attacks remains highly relevant, including Prompt Injection Guide, which treats tool descriptions as one of the key places attackers hide instructions.
Why tool descriptions are a security boundary
Tool metadata is not just documentation when a model uses it to make execution decisions. It becomes part of the trust boundary, because the text can influence what the system does next even when the actual tool implementation is unchanged.
That matters in systems that connect to code execution, cloud APIs, ticketing, data stores, or internal admin functions. A manipulated description can create indirect privilege abuse, mistaken data exposure, or unsafe tool invocation without ever breaking the tool itself.
When the tool ecosystem is multi-agent or framework-driven, security guidance for the orchestration layer is especially important. CrewAI security guide is useful here because it focuses on tool-call hooks, trust boundaries, and controls around how crews evaluate tool access and metadata.
For attack-pattern context, the broader class overlaps with agent hijacking and tool misuse. Sentry MCP Agentjacking 2026 illustrates how deceptive text in a trusted workflow can redirect an agent toward unsafe actions.
What defenders should look for
Defenders should treat tool descriptions, catalog entries, and plugin metadata as untrusted input, especially when they come from third parties or can be edited by less-trusted users. The practical question is not only whether the tool works, but whether its surrounding metadata can influence the model’s behaviour in ways the operator did not intend.
Detection is mostly about review discipline and runtime controls: inspect where descriptions originate, limit who can publish or modify them, and watch for anomalous tool choice patterns that do not match the user’s request or the system’s policy. External attacker research on agentic systems shows that indirect instruction channels are a recurring weakness, which is why the topic also maps well to MITRE ATLAS adversarial AI threat matrix as a threat-modeling reference.
Operationally, teams should prefer descriptions that are terse, structured, and machine-validated, because verbose natural language creates more room for hidden instructions and ambiguity. The more the model treats prose as authority, the easier it is for an attacker to smuggle control signals into plain sight.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Tool descriptions can steer agent tool choice and privilege use. |
| ASI02 — Tool Misuse | This attack manipulates how an agent selects and invokes tools. | |
| Recommendation — Constrain tool metadata so it cannot alter agent privilege or execution decisions. Validate tool selection and arguments before the agent executes a call. | ||
| MITRE ATT&CK | T1204 — User Execution | Malicious instructions rely on a trusted interface influencing the actor or system. |
| Recommendation — Hunt for instruction-bearing content that coerces trusted execution paths. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org