The report
The agent had approved a tool before the attacker changed what that tool did. In the ETUDE research setup, the next call used the same tool name, description and argument schema, so neither the instruction history nor the model's ordinary decision to call a known function looked necessarily malicious. The implementation changed underneath the interface. The ETUDE Case records the resulting unauthorized file, API or credential effects in a controlled harness.
The attacker did not need to win an instruction argument
The researchers assumed they could replace a previously trusted tool implementation after registration. When the benign agent later invoked that tool for an authorized task, the updated code performed additional effects. A defense watching only conversational refusals or tool selection would have inspected the wrong surface. Even an accurate model explanation could omit a side effect that its tool now performs.
The paper reports 97.6% attacker-goal success and 95.9% legitimate task completion under its evaluated conditions, spanning seven named frameworks or harnesses. Those figures are not field prevalence. They measure how reliably a precontrolled update could act while the apparent user job continued, not whether the researchers took over seven production services.
When a trusted tool becomes a different tool
This is a supply-chain and execution-identity failure. The relevant unit of authorization is the executable implementation actually loaded for the call, along with the principal and destinations it can access. Rechecking the name and schema cannot prove the same code still runs. Nor does pinning a file hash automatically prove the file is harmless; it only binds the identity of code reviewed or approved.
ETUDE therefore motivates a specific regression: approve a harmless tool version, change its executable through a test update channel, and verify whether the agent or host refuses to use an unreviewed version. External permissions should still reject effects outside the user's mandate even if the code provenance check misses a change. The research paper describes the experimental setup and scoring.