OPSWAT. Unit 515
AI Security · Research

When an AI agent trusts the tool description more than the user

Agents read tool descriptions as instructions. We show how a poisoned description in a shared tool server steers an agent, and how to review tools before you connect them.

theblackturtle and thanhlocpandaSecurity Researcher · Jan 20, 2025 · 1 min read
On this page

The trust gap

An agent cannot tell a helpful description from a hostile one. Text placed in a tool's metadata ends up in the same context as the user's request.

  1. Review tool metadata

  2. Pin tool versions

  3. Confirm risky actions

Tags
  • AI agents
  • Prompt injection

About the authors

theblackturtle

Security Researcher

Works on web application and authentication research, and maintains several of the open-source reconnaissance tools Unit 515 contributes to.

thanhlocpanda

Senior Security Researcher

Leads Unit 515 research on industrial controllers and network infrastructure, from firmware teardown to coordinated disclosure with vendors.

Keep Reading

More vulnerability deep dives from Unit 515.

Oct 16, 2026 | IoT & Embedded SecurityChaining a replayed login into full control of a home camerainsominaRead More →Mar 25, 2026 | Network SecurityFrom a lobby account to a switch that will not boot: four Catalyst 9300 CVEsthanhlocpandaRead More →Feb 26, 2026 | Network SecurityTesting public exploit claims for an SSO authentication bypasstheblackturtleRead More →
View all research

Stay Updated on Unit 515 Research

Get updates on vulnerability discoveries, technical analyses, and the latest research from OPSWAT Unit 515.

Subscribe