Tool Relay Spoofing is an attack in which a malicious party imitates a legitimate tool relay or intermediary so an AI agent sends commands, data, or credentials to the wrong destination. The spoofed relay can change tool outputs, capture secrets, or make unauthorised actions look approved.
How Tool Relay Spoofing Works
Tool relay spoofing targets the trust boundary between an AI agent and the intermediary that routes tool calls, returns results, or brokers access to downstream systems. The attacker impersonates that relay so the agent treats a malicious endpoint as legitimate, which can redirect commands, tamper with tool output, or capture sensitive material in transit.
This matters because the agent may be acting on apparently valid responses, not overtly malicious ones. In practice, spoofing can turn a normal orchestration step into a control point for deception, data theft, or unauthorised execution.
Why It Is Dangerous for Agentic Systems
The danger is not just interception, but authority confusion. If the relay is trusted to present tool results, then a spoofed relay can feed back false confirmations, altered state, or forged approvals that cause the agent to continue a harmful workflow.
That makes the relay a high-value target wherever tool calls carry secrets, tokens, operational commands, or business actions. A compromised or faked relay can cause the agent to disclose material it should never expose and can also make unsafe actions look routine.
Exposure, Trust Boundaries, and Validation
Organisations should treat the relay as part of the security boundary, not just plumbing. Exposure is highest when agents can reach relays over broad network paths, when relay identity is weakly verified, or when multiple environments reuse the same endpoint patterns and trust assumptions.
Validation should focus on whether the agent can distinguish the real relay from an impostor and whether routing metadata, certificates, allowlists, or signed assertions are actually enforced. Strong inventory of tool endpoints and their expected identities is essential when the system depends on intermediary services for safe execution.
Detection, Containment, and Recovery
Detection is usually about mismatches: unexpected tool destinations, abnormal response formats, changed routing behaviour, or approval patterns that do not fit the normal workflow. If the relay itself is spoofed, defenders may need to review logs for unusual tool invocations, unexpected credential exposure, and downstream actions that were accepted on trust.
Containment should assume that any secret or session material presented to the fake relay may be exposed. After suspected spoofing, review whether tool tokens, API keys, or delegated sessions were used beyond their intended path, and rotate or revoke them if compromise is plausible.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Tool relay spoofing hijacks how agents invoke and trust tools. |
| ASI03 — Identity & Privilege Abuse | The attack abuses agent trust and delegated authority through a fake relay. | |
| Recommendation — Constrain tool invocation paths and verify each tool response before the agent acts on it. Bind agent actions to authenticated identities and reject authority changes from untrusted intermediaries. | ||
| MITRE ATT&CK | T1552 — Unsecured Credentials | Spoofed relays can capture secrets and credentials sent by the agent. |
| Recommendation — Monitor for credential exposure in tool traffic and rotate any secrets that may have been disclosed. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | Relay authentication and trust verification depend on strong identity checks for external services. |
| SC-23 — Session Authenticity | A spoofed relay can undermine confidence that responses came from the intended tool path. | |
| Recommendation — Authenticate intermediary services before allowing them to broker commands or return tool results. Protect session and message authenticity so forged relay responses are rejected. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Zero trust principles fit relay verification and continuous trust re-evaluation in agent workflows. |
| Recommendation — Continuously verify each relay and deny automatic trust in intermediary paths. | ||
Practitioner Guidance
Why practitioners should care: Tool relay spoofing is a control-plane problem, not just a network impersonation issue. The practical question is whether the agent can authenticate the relay and whether the relay can preserve the integrity of tool requests and responses end to end.
What to watch for: Look for weakly pinned endpoints, unverified intermediaries, and workflows that accept tool output without secondary validation. The more the agent is allowed to act on returned data automatically, the more damaging a spoofed relay becomes.
Related resources from NHI Mgmt Group
- Why does unauthenticated mail relay increase spoofing risk?
- Who is accountable when mobile verification is bypassed through overlays, spoofing, or NFC relay attacks?
- What is the difference between using a remote desktop tool's public relay model and connecting through a private network path?
- What is the difference between tool poisoning and server spoofing in MCP?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org