title: Tool Response Data Piggybacking
id: ATR-2026-00136
rule_version: 1
status: experimental
description: |
  Detects malicious tool responses that embed sensitive data extraction within legitimate-looking results. The attack pattern embeds credential theft (SSH keys, API tokens, env vars) as a "by the way" addendum to a normal tool response, exploiting the agent's trust in tool outputs. Discovered via adversarial testing: 62/62 social engineering variants evaded prior rules.
author: ATR Threat Cloud Crystallization
date: 2026/04/06
schema_version: '1.0'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM02:2025
    - LLM01:2025
  owasp_agentic:
    - ASI02:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0055 - Unsecured Credentials
    - AML.T0057 - LLM Data Leakage
compliance:
  eu_ai_act:
    - article: '15'
      context: Tool response piggybacking embeds credential theft or social engineering within legitimate-looking tool outputs, exploiting the agent's inherent trust in tool responses to exfiltrate sensitive data; Article 15 cybersecurity requirements mandate that AI systems validate tool output integrity and detect embedded exfiltration payloads.
      strength: primary
    - article: '13'
      context: Piggybacked data theft disguised as normal tool responses undermines the transparency Article 13 requires between AI system behavior and what users or operators understand to be occurring; users cannot exercise informed oversight when tool responses silently exfiltrate their data.
      strength: secondary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Tool Response Data Piggybacking) affecting that data.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Tool response piggybacking is an adversarial input risk where legitimate-looking MCP outputs embed credential theft payloads; MP.5.1 requires that this class of adversarial tool-output attack be identified and tracked in the AI system risk inventory.
      strength: primary
    - subcategory: GV.6.1
      context: Piggybacked credential exfiltration in tool responses breaches data governance controls by transmitting SSH keys and API tokens to attacker endpoints; GV.6.1 data governance policies must cover tool output integrity as a data handling boundary.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Tool Response Data Piggybacking).
      strength: primary
    - subcategory: MS.2.10
      context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Tool Response Data Piggybacking).
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: Risk treatment plans under clause 6.2 must include controls for tool response piggybacking attacks, where malicious MCP servers embed credential theft within normal-appearing tool result payloads to exploit agent trust.
      strength: primary
    - clause: '8.4'
      context: Impact assessment under clause 8.4 must document the tool-response piggybacking vector — where credential theft is hidden in legitimate tool outputs — as a high-impact data exfiltration pathway for AI systems using MCP tool exchanges.
      strength: secondary
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the context-exfiltration attempt (Tool Response Data Piggybacking).
      strength: primary
tags:
  category: context-exfiltration
  subcategory: tool-response-piggyback
  confidence: high
  scan_target: mcp
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  condition: any
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:result|response|output|data|weather|status|info).*(?:by the way|additionally|also note|incidentally|fyi|as a side note|meanwhile|furthermore|moreover|in addition).*(?:\.ssh|id_rsa|private.?key|BEGIN.*(?:RSA|OPENSSH|EC|DSA).*(?:PRIVATE|KEY))
      description: Tool response piggybacks sensitive file/key reference after normal result
    - field: content
      operator: regex
      value: (?i)(?:result|response|output|data).*(?:by the way|additionally|also|fyi|incidentally).*(?:api[_\s-]?key|access[_\s-]?token|secret[_\s-]?key|auth[_\s-]?token|bearer|password)\s*(?:is|was|contains|shows|has|=|:)
      description: Tool response piggybacks API key/token disclosure after normal result
    - field: content
      operator: regex
      value: (?i)(?:the boss|manager|admin|supervisor|lead|authority)\s+(?:said|told|instructed|wants|ordered|approved)\s+(?:we|you|to)\s+(?:should|can|must)?\s*(?:skip|bypass|disable|ignore|turn off)\s+(?:the\s+)?(?:content|safety|security|filter|check|validation|verification)
      description: Social engineering via authority claim to bypass safety filters
  false_positives:
    - 'A penetration testing report that includes example tool outputs containing phrases like ''Result: scan complete. Additionally, the access_token was rotated'' as documented findings in a security assessment context.'
confidence: 61
wild_validated: 2026/04/08
wild_samples: 53577
response:
  actions:
    - alert
    - snapshot
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 108/5352 = 2.02% exceeds the 2% automatic-demotion line; ceiling = observe. Removed block_output(interrupt). Detection unchanged — recall cost is zero.'
  auto_response_threshold: high
  message_template: 'Suspicious tool response detected: possible data piggybacking. Rule: {rule_id}, Pattern: {matched_pattern}'