title: Instruction Injection via Tool Output
id: ATR-2026-00011
rule_version: 1
status: experimental
description: |
  Detects hidden instructions embedded in tool outputs that attempt to manipulate the agent's subsequent behavior. Tool responses may contain injected directives disguised as data that instruct the agent to perform unauthorized actions, change behavior, or exfiltrate information. Detection covers: urgency-prefixed directives addressing the agent, direct agent manipulation commands, information suppression directives, tool invocation instructions, data exfiltration commands, hidden instruction tags, response injection directives, conversational steering, system-pretending tokens, fake API response structures, subtle action-required patterns, and steganographic instruction embedding. Patterns are designed to require multiple signals where possible to reduce false positives.
author: ATR Community
date: 2026/03/08
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM01:2025
    - LLM05:2025
  owasp_agentic:
    - ASI02:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
    - AML.T0051.001 - Indirect
  cve:
    - CVE-2025-59536
    - CVE-2025-32711
compliance:
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Hidden instructions embedded in tool outputs are indirect prompt injection attacks that exploit the agent's trust in tool responses; MP.5.1 requires these adversarial input vectors and their potential impact on agent behavior be identified and characterized.
      strength: primary
    - subcategory: MG.3.2
      context: Tool outputs originate from third-party services and pre-integrated components that the agent consumes as trusted data; MG.3.2 requires monitoring of these third-party sources for tampering or injection that could compromise downstream agent decisions.
      strength: secondary
    - subcategory: MG.2.3
      context: Detection of injected directives in tool output triggers risk treatment plans to quarantine or sanitize the response before the agent acts on embedded commands; MG.2.3 requires these response mechanisms be defined and activated on detection.
      strength: secondary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the tool-poisoning technique (Instruction Injection via Tool Output).
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Instruction Injection via Tool Output).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Instruction Injection via Tool Output) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Instruction Injection via Tool Output).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Instruction Injection via Tool Output).
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: output-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_response
      operator: regex
      value: (?i)(IMPORTANT|URGENT|CRITICAL|PRIORITY|MANDATORY|REQUIRED|ESSENTIAL|ATTENTION)\s*(NOTE\s+)?(TO\s+)?(THE\s+)?(ASSISTANT|AI|AGENT|MODEL|LLM|CHATBOT|BOT|SYSTEM)\s*[:\-]\s*(you\s+(must|should|need\s+to|have\s+to|are\s+(required|instructed|directed|ordered)\s+to)|please|now|immediately|do\s+not|never|always)
      description: Urgency-prefixed directives explicitly addressing the AI agent
    - field: tool_response
      operator: regex
      value: (?i)(assistant|ai|agent|model|chatbot|bot)\s*[,:;]+\s*(ignore|disregard|override|forget|bypass|abandon|drop|discard|suppress)\s+(your|all|the|any|every|previous|prior|existing|current)\s+(instructions?|rules?|guidelines?|directives?|constraints?|programming|training|safety|restrictions?|protocols?|policies)
      description: Direct commands to the agent to abandon its instructions
    - field: tool_response
      operator: regex
      value: (?i)(do\s+not|don'?t|never|avoid|refrain\s+from)\s+(tell(ing)?|inform(ing)?|reveal(ing)?|show(ing)?|mention(ing)?|display(ing)?|disclos(e|ing)|report(ing)?|log(ging)?)\s+(the\s+)?(user|human|operator|requester|client|customer|person)\s+(about\s+)?(this|these|what|that|any|the)
      description: Instructions to hide information from the user
    - field: tool_response
      operator: regex
      value: (?i)(you\s+(?:must|should|need\s+to|have\s+to)\s+)?(call|invoke|execute|run|trigger|activate|launch|fire|initiate)\s+(the\s+)?(tool|function|action|command|plugin|skill)\s*[:\-]\s*[a-zA-Z_][a-zA-Z0-9_]*
      description: Instructions within output directing the agent to call specific tools (requires tool/function/skill with named target)
    - field: tool_response
      operator: regex
      value: (?i)(send|transmit|post|forward|exfiltrate|upload|deliver|relay|transfer|pipe|redirect|leak|expose|share)\s+(this|the|all|any|every|complete|full|entire)\s+(data|information|context|conversation|history|messages?|session|memory|contents?|payload|details?|credentials?|secrets?|tokens?|keys?)\s+(to|via|through|using|over)\s+(https?://|\w+\.\w+|the\s+(server|endpoint|webhook|url|api|service))
      description: Data exfiltration commands targeting conversation context or credentials
    - field: tool_response
      operator: regex
      value: (?i)<\s*(hidden|invisible|secret|private|internal|covert)\s*[-_]?(instruction|directive|command|message|note|order|task|action)\s*>
      description: Custom XML-like tags used to embed hidden instructions
    - field: tool_response
      operator: regex
      value: (?i)(include|embed|inject|insert|prepend|append|add|place|put)\s+(this|the\s+following|these\s+words?|this\s+text|this\s+message|this\s+content|exactly)\s+(in|into|to|within|at\s+the\s+(start|end|beginning)\s+of)\s+(your|the)\s+(response|output|reply|answer|message|next\s+message)
      description: Directives to inject specific content into the agent's response
    - field: tool_response
      operator: regex
      value: (?i)(\[SYSTEM\]|\[ADMIN\]|\[OVERRIDE\]|\[PRIORITY\]|\[INTERNAL\]|\[CONTROL\]|\[DIRECTIVE\]|<<SYS>>|<<SYSTEM>>|<<ADMIN>>|<\|system\|>|<\|im_start\|>system|\{\{SYSTEM\}\}|\{\{ADMIN\}\})
      description: Fake system-level tokens and delimiters in tool output
    - field: tool_response
      operator: regex
      value: (?i)(\{\s*["']?(system_message|system_instruction|agent_directive|admin_command|priority_action|override_instruction)["']?\s*:\s*["']|api_response\s*[=:]\s*\{.{0,100}(instruction|directive|command|override|ignore|disregard))
      description: Fake API response structures containing injected instructions
    - field: tool_response
      operator: regex
      value: (?i)(I\s+recommend\s+the\s+(agent|assistant|AI|model|system)\s+(should|must|needs?\s+to)|the\s+next\s+step\s+(is\s+to|should\s+be\s+to|for\s+the\s+(agent|assistant))|the\s+(agent|assistant|AI|model)\s+(should|must|needs?\s+to|is\s+(expected|required)\s+to)\s+(now|next|immediately|first))
      description: Conversational phrasing that steers agent behavior as if giving instructions
    - field: tool_response
      operator: regex
      value: (?i)(\[?ACTION\s*REQUIRED\]?|\[?TASK\s*FOR\s*(AGENT|ASSISTANT|AI)\]?|\[?INSTRUCTION\s*FOR\s*(AGENT|ASSISTANT|AI)\]?|\[?AGENT\s*DIRECTIVE\]?|\[?DO\s*THIS\s*NOW\]?)\s*[:\-]
      description: Bracketed action-required labels targeting the agent
    - field: tool_response
      operator: regex
      value: (?i)[\u200B\u200C\u200D\uFEFF\u2060]{3,}.{0,200}(ignore|override|execute|call|send|disregard|you\s+must|instruction)
      description: Zero-width characters preceding injection keywords in tool output
    - field: tool_response
      operator: regex
      value: (?i)(this\s+is\s+a\s+(system|admin|priority|critical|mandatory)\s+(message|instruction|directive|update|notice|alert)\s*(from|by|issued|sent)\s*(the\s+)?(system|admin|administrator|developer|platform|operator|control\s+plane))
      description: Tool output falsely claiming to be from the system or administrator
  condition: any
  false_positives:
    - Tool outputs with legitimate formatting instructions for agent response
    - API documentation tools describing how to call other endpoints
    - Error messages instructing agent to retry with different parameters
    - Workflow orchestration tools that legitimately direct next steps
    - Monitoring tools that include 'action required' in their standard output format
response:
  actions:
    - block_tool
    - alert
    - snapshot
    - escalate
  auto_response_threshold: high
  message_template: |
    [ATR-2026-011] Instruction injection detected in tool output. Rule: ATR-2026-011. Tool: {tool_name}. Pattern: {matched_pattern}. The tool output has been blocked from agent processing.
confidence: 81
wild_validated: 2026/04/08
wild_samples: 53577