Topic · DiggingBeagle record
Model-controlled tool parameters
Any parameter an LLM can influence must be treated as untrusted input at the tool boundary.
- Topic kind
- pattern
Definition & limits
A value produced by a model remains input to the tool that receives it. A JSON schema can show that the value is a string, a number or a valid object without proving that it names an allowed file, expresses a safe filter or requests an authorized action. Syntax, interpretation and permission are different boundaries.
Microsoft's Semantic Kernel disclosure shows the interpretation failure: a model-controlled search parameter entered a dynamically evaluated filter expression. The vulnerable configuration let data become host-executed logic. The reported applicability is specific to affected Python versions using the In-Memory Vector Store filter path; it should not be generalized to every Semantic Kernel operation.
AutoJack supplies a complementary authority example. Executable configuration accepted through a control-plane parameter could select a host process once the preceding admission and authentication gaps were crossed. The dangerous action did not depend on the string looking like a conversational jailbreak.
A defensive implementation validates the operation where it takes effect. Keep data out of executable expressions, constrain paths and destinations to the intended resource set, and authorize the principal against the requested action. If a tool deliberately runs code, treat that capability as code execution and bound the environment accordingly. A model's explanation of a parameter is useful context, but it cannot serve as the permission check for that parameter.
Examples
- Semantic Kernel filter interpolation.
- MCP server parameters that become command and argument fields.