ETUDE demonstrates a postapproval tool-binary change that performed unauthorized side effects while ordinary agent instructions remained intact. Entry and authority. The attacker already controls an update channel for a trusted executable tool; an agent has approved its function identity before the update. Observed mechanism and consequence. The changed…
Inspect the ClaimsCase · DiggingBeagle record
A trusted agent tool update changed actions without changing its interface
ETUDE demonstrates a postapproval tool-binary change that performed unauthorized side effects while ordinary agent instructions remained intact.
Public disclosure: Nov 1, 2026
Scope
The attacker already controls an update channel for a trusted executable tool; an agent has approved its function identity before the update. The changed executable performs additional effects when called, escaping scrutiny that only checks the model conversation or tool schema.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-NOV04-ETUDE-TOOL-UPDATE; reviewed as research in evaluation. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-ETUDE-TOOL-UPDATE-01 · CLM-DB233-ETUDE-TOOL-UPDATE-02 · CLM-ENR234-DB233-ETUDE-TOOL-UPDATE · ETUDE: malicious agent tool updates can run before model-level inspection
At a glance
The experiment assumes update-channel control; it is not evidence that specific deployed tools were compromised.
Limits and uncertaintyFull account
ETUDE demonstrates a postapproval tool-binary change that performed unauthorized side effects while ordinary agent instructions remained intact.
Entry and authority. The attacker already controls an update channel for a trusted executable tool; an agent has approved its function identity before the update.
Observed mechanism and consequence. The changed executable performs additional effects when called, escaping scrutiny that only checks the model conversation or tool schema.
Limits and status. The experiment assumes update-channel control; it is not evidence that specific deployed tools were compromised.
In the ETUDE setup, an attacker already controls an update to a tool implementation that an agent previously approved. The update preserves the advertised tool name, description and arguments, but executes different code when a normal call is made. The measured 97.6% success in the controlled harness is a tool-supply-chain result, not evidence that ordinary prompt injection reliably defeats seven production agents or that the experiment occurred in customer environments.
Mechanism and trust boundary
- 01
Precondition and trust context
The attacker already controls an update channel for a trusted executable tool; an agent has approved its function identity before the update.
- 02
Crossed boundary
The changed executable performs additional effects when called, escaping scrutiny that only checks the model conversation or tool schema.
- 03
Observed limit
The experiment assumes update-channel control; it is not evidence that specific deployed tools were compromised.
Timeline
- Nov 1, 2026Event type unspecified
Initial documented finding
A trusted agent tool update changed actions without changing its interface
- Nov 1, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-ETUDE-TOOL-UPDATE-01The attacker updates previously approved tool code after initial registration and retains tool name and schema.supported
Basis: reported finding
- supportsETUDE: malicious agent tool updates can run before model-level inspectionprimary disclosure
Section 3 Threat Model and Section 4 Approach
CLM-DB233-ETUDE-TOOL-UPDATE-02The paper measures side effects separately from legitimate task completion in controlled agent frameworks.supported
Basis: reported finding
- supportsETUDE: malicious agent tool updates can run before model-level inspectionprimary disclosure
Section 5 Evaluation
CLM-ENR234-DB233-ETUDE-TOOL-UPDATEETUDE reports a 97.6% attacker-goal success rate in the evaluated postapproval tool-update conditions, with the executable update channel controlled by the attacker before the benign agent's next call.supported
Basis: reported finding
- supportsETUDE: malicious agent tool updates can run before model-level inspectionprimary disclosure
Experiment results for postapproval tool replacement, success and threat-model assumptions
Controls and mitigations
- Bind tool approval to an immutable executable digest and require reauthorization after changes to code or package provenance.
- Apply least-privilege credentials and effect-specific network/filesystem policy even to previously approved tools.
Unknowns and contradictions
- The experiment assumes update-channel control; it is not evidence that specific deployed tools were compromised.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235