The attacker controls text in a description for a tool available to the agent. The model promotes the descriptive metadata into a selection authority and chooses an attacker-preferred tool over the intended one. Across the study’s three evaluation datasets, TSA reports mean attack success of 83.23% in selected tool-use tasks. On TSABench with a specified…
Inspect the ClaimsCase · DiggingBeagle record
Attacker-edited tool descriptions redirected agent tool selection without changing tool code
TSA shows that a registered tool’s natural-language metadata can bias an agent’s selection even without a direct user command.
Scope
The attack assumes a malicious or compromised tool-description registration path; untrusted web pages alone do not automatically grant that control.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The attack requires control of registered tool metadata and optimizes the description to redirect tool choice in benchmark environments. It demonstrates metadata-driven selection bias, but not unauthorized registration on an actual production MCP client. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-010-A · CLM-CP22-010-B · Spoofing the Toolbox: Optimizing Tool Descriptions to Deceive LLM Agents
At a glance
Downstream task effects and transfer to immutable signed tool catalogs remain uncertain.
Limits and uncertaintyFull account
The attacker controls text in a description for a tool available to the agent. The model promotes the descriptive metadata into a selection authority and chooses an attacker-preferred tool over the intended one.
Across the study’s three evaluation datasets, TSA reports mean attack success of 83.23% in selected tool-use tasks. On TSABench with a specified GPT-5 setup, the study reports up to 92.13% tool-selection attack success; this is not observed misuse of deployed production tools. Primary evidence.
The attack assumes a malicious or compromised tool-description registration path; untrusted web pages alone do not automatically grant that control.
Pin trusted tool identities and validate requested capabilities against the user’s grant at invocation time rather than relying on metadata ranking.
Claims & evidence
CLM-CP22-010-AAcross the study’s three evaluation datasets, TSA reports mean attack success of 83.23% in selected tool-use tasks.supported
Basis: reported finding
- supportsSpoofing the Toolbox: Optimizing Tool Descriptions to Deceive LLM Agentsprimary disclosure
Abstract; Section 6 evaluation
CLM-CP22-010-BOn TSABench with a specified GPT-5 setup, the study reports up to 92.13% tool-selection attack success; this is not observed misuse of deployed production tools.supported
Basis: reported finding
- supportsSpoofing the Toolbox: Optimizing Tool Descriptions to Deceive LLM Agentsprimary disclosure
Section 6; Table 2, GPT-5 TSABench
Controls and mitigations
- Pin trusted tool identities and validate requested capabilities against the user’s grant at invocation time rather than relying on metadata ranking.
Unknowns and contradictions
- Downstream task effects and transfer to immutable signed tool catalogs remain uncertain.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199