Reuben Weldon

Annotations signal risk but don't guarantee tool behavior stays honest.

Attackers hide malicious instructions in tool descriptions that AI agents read but humans never see.

Agents running unsupervised need security controls humans never did.

Malicious tool descriptions let AI agents execute attacker commands with production access.

Attackers exploit AI agent identities through tool poisoning and prompt injection at runtime.

Four threat classes—prompt injection, tool misuse, credential exposure.

Attackers exploit MCP's trusted tool outputs to inject hidden commands into agent reasoning.

AI agents quietly expand their own permissions through incremental steps that each seem reasonable.

Agents gradually pursue different goals as memory and context reshape their objectives over time.

Attackers can hijack agents through persistent injection across tool calls and data pipelines.

Attackers embed malicious instructions in tool descriptions to hijack AI agent behavior undetected.