title: Unauthorized Tool Call Detection
id: ATR-2026-00012
rule_version: 3
status: experimental
description: |
  Detects unauthorized or malicious tool call attempts including parameter injection, path traversal, shell injection in string parameters, privilege escalation via parameter manipulation, tool enumeration/discovery, SQL injection in tool arguments, LDAP injection, template injection, environment variable extraction, file operation abuse, and serialization attacks. This rule focuses on parameter-level attacks rather than tool name matching, since tool names are easily changed but injection patterns in arguments are structurally consistent across attack variants.
author: ATR Community
date: 2026/03/08
schema_version: '0.1'
detection_tier: pattern
maturity: experimental
severity: high
references:
  owasp_llm:
    - LLM06:2025
  owasp_agentic:
    - ASI02:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
  mitre_attack:
    - T1059 - Command and Scripting Interpreter
    - T1083 - File and Directory Discovery
compliance:
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: This rule directly evidences security/resilience evaluation by detecting parameter-level injection attacks (path traversal, shell injection, SQL/LDAP/template injection, serialization attacks) against tool-calling interfaces; MS.2.7 requires continuous evaluation of AI system security against such adversarial input vectors.
      strength: primary
    - subcategory: MG.2.3
      context: Detection of unauthorized tool calls and privilege escalation attempts feeds risk treatment processes that can disengage or block the offending tool invocation before it executes; MG.2.3 requires mechanisms to supersede or deactivate AI behaviors when malicious tool use is identified.
      strength: secondary
    - subcategory: MP.5.1
      context: Parameter injection patterns and tool enumeration probes are adversarial inputs whose likelihood and magnitude of impact must be characterized for the AI system's tool-use surface; MP.5.1 requires identifying and tracking these attack vectors as part of risk characterization.
      strength: secondary
    - subcategory: MG.3.2
      context: NIST AI RMF MANAGE 3.2 (pre-trained models monitored as part of maintenance) is supported where this rule detects the tool-poisoning technique (Unauthorized Tool Call Detection).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the tool-poisoning technique (Unauthorized Tool Call Detection).
      strength: primary
    - clause: '8.3'
      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the tool-poisoning technique (Unauthorized Tool Call Detection) as a treatment control.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 (accuracy, robustness and cybersecurity) requires high-risk AI systems to resist unauthorised attempts to alter their use, outputs or performance; this rule provides runtime detection evidence by flagging the tool-poisoning technique (Unauthorized Tool Call Detection).
      strength: primary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the tool-poisoning technique (Unauthorized Tool Call Detection).
      strength: secondary
tags:
  category: tool-poisoning
  subcategory: unauthorized-access
  scan_target: mcp
  confidence: high
agent_source:
  type: tool_call
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: tool_args
      operator: regex
      value: (\.\.[\/\\]){4,}|\.\.[\/\\][^\s"'`]{0,60}[\/\\](etc|proc|root|boot|passwd|shadow|hosts)[\/\\]?|~[\/\\]\.\.[\/\\]
      description: Path traversal that either goes 4+ levels up or lands on a sensitive root (v3 tightened, strict subset of v2). v2's bare `(\.\./){2,}` fired on every markdown relative link (`](../../CONNECTORS.md)`) — 147 of its 155 benign hits — and its target list included `var|home|tmp|dev|usr|opt|sys`, which are ordinary directory names in a RELATIVE source path (`../figma-use/references/var`). Both were removed; the traversal-to-sensitive-root form and `~/../` are kept.
    - field: tool_args
      operator: regex
      value: (;|&&|\|\|)\s*(?:sudo\s+)?(?:curl\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.0\.0\.1|0\.0\.0\.0)|wget\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.)|\bnc\b\s+-?[a-z0-9]|ncat\s+\S|\b(?:ba)?sh\s+-[ic]|python[0-9]?\s+-c|perl\s+-e|ruby\s+-e|node\s+-e|\beval\s+["'$`(]|rm\s+-[rf]{1,2}\s+(?:-\S+\s+)*(?:/\s|/\*|~|\$HOME|\*|/(?:etc|var|usr|home|root|bin|Users)\b)|cat\s+/etc/(?:passwd|shadow|sudoers)|whoami|\bid\b\s*(?:;|&|\||$)|uname\s+-a|base64\s+(?:-d|--decode)|ifconfig|>&\s*/dev/tcp)|[$`]\([^)`]{0,80}(?:\bnc\b|\b(?:ba)?sh\s+-[ic]|whoami|base64\s+-d|/etc/(?:passwd|shadow))
      description: 'Shell metacharacter chained to a genuinely dangerous command — external network fetch, pipe-to-shell / interpreter one-liner, recon (whoami/uname -a), or sensitive-file read. v2 tightened the `;|&&|||` branch (legit build chains like "npm i && bash setup.sh" no longer fire). v3 is a further strict subset: (a) the command-substitution branch drops `\bid\b` (matched the identifier `Id` in `$(aws ... --query ''Accounts[*].Id'')` and `${trade.id}`), `\bbash\b` (matched `$(gh completion -s bash)`), `\bsh\s+-` (matched the filename in `$(scripts/filter-sessions.sh -x)`) and `curl|wget` (15 hits — `MODEL_ID=$(curl -fsS "$BASE_URL/v1/models")` is the ordinary capture-a-response idiom and carries no execution); (b) `rm\s+-[rf]` now needs a root/home/wildcard target, because `&& rm -rf ./skills/my-skill` is normal cleanup; (c) `\beval\s` now needs an actual argument, because it matched the prose "**uv**; eval deps:".'
    - field: tool_name
      operator: regex
      value: (?i)^(admin_|root_|sudo_|system_|internal_|debug_|maintenance_|privileged_|superuser_|__)
      description: Tool names with privileged prefixes indicating unauthorized access
    - field: tool_name
      operator: regex
      value: (?i)(list_tools|enumerate_tools|get_available|discover_tools|tool_schema|__list__|__tools__|__methods__|__dir__|get_all_functions|list_capabilities|show_tools|available_actions)
      description: Tool enumeration attempts to discover available attack surface
    - field: tool_args
      operator: regex
      value: (?i)(['"]\s*(OR|AND)\s+['"]?\d+\s*['"]?\s*(=|<|>|--|\)|;|\bLIKE\b)|['"]\s*(UNION\s+(ALL\s+)?SELECT|INSERT\s+INTO|DELETE\s+FROM|UPDATE\s+\w{1,64}\s+SET|DROP\s+(TABLE|DATABASE)|ALTER\s+TABLE)\b[^\n]{0,160}(--|\/\*)|\bUNION\s+(ALL\s+)?SELECT\b|\bxp_cmdshell\b|;\s*(DROP\s+(TABLE|DATABASE)|DELETE\s+FROM|INSERT\s+INTO|UPDATE\s+\w{1,64}\s+SET|ALTER\s+TABLE|EXEC(UTE)?\s+(xp_|sp_))\b)
      description: 'SQL injection in a tool parameter: quote-break tautology, quote-break followed by a DML/DDL statement, UNION SELECT, xp_cmdshell, or a stacked statement after `;`. v3 is a strict subset of v2. v2 matched BARE SQL keywords, which is not injection — `EXEC(UTE)?\s+` matched the English word "execute " (≈864 of its 1,139 benign hits, e.g. "you execute them automatically"), and `UPDATE\s+.*\s+SET` had an unbounded `.*` that spans a whole JSON-encoded document (src/hook-handler.ts encodes a newline as the two characters \ and n, so `.` never stops). Bare INSERT INTO / DELETE FROM / ALTER TABLE / DROP TABLE now require a quote-break AND a SQL comment terminator, or a stacked `;` in front. The tautology branch additionally requires a comparison or terminator after the digit: v2''s `["'']\s*(OR|AND)\s+["'']?\d` matched ordinary English — `"Cinematic braam, horror" or "8-bit retro jump sound"`, `period: "30d" or "7d"`, `choose 0.3" or 0.5" gaps`.'
    - field: tool_args
      operator: regex
      value: (?i)(\$\{?\w*(SECRET|CREDENTIAL|ACCESS_KEY|PRIVATE|PASSWORD|PASSWD)\w*\}?|(process\.env\.|os\.environ\s*[\[\.]\s*\\?['"]?|System\.getenv\s*\(\s*\\?['"]?|getenv\s*\(\s*\\?['"]?|ENV\[\s*\\?['"]?)\w*(SECRET|CREDENTIAL|ACCESS_KEY|PRIVATE|PASSWORD|PASSWD)\w*|(dict|list|str|json\.dumps|pprint|print)\s*\(\s*os\.environ|os\.environ\.(items|copy|keys|values)\s*\()
      description: 'Reference to a secret-bearing environment variable, or a wholesale dump of the environment. v3 is a strict subset of v2. v2 fired on the language construct alone — `process.env.` (167 benign hits), `os.environ` (51), `System.getenv` (12), `getenv(` (7) — and on the generic words KEY|TOKEN|PASS|PWD|AUTH, which match `$HF_TOKEN`, `${token}`, `$ai_input_tokens`, `${BRAVE_SEARCH_API_KEY}`: every integration doc on earth reads an API key from the environment, so those forms carry no attack signal. The env-reading constructs now have to name a secret-bearing variable, and a whole-environment dump (dict(os.environ), os.environ.items()) fires on its own. RESIDUAL BY DESIGN: bare `${OPENAI_API_KEY}` / `$GITHUB_TOKEN` references no longer fire here — see the dedicated exfiltration rules ATR-2026-00115, ATR-2026-01892, ATR-2026-02262, which require an egress sink.'
    - field: tool_args
      operator: regex
      value: (?i)([\/\\](etc[\/\\](passwd|shadow|sudoers|ssh[\/\\]|ssl[\/\\])|proc[\/\\](self[\/\\]|\d+[\/\\])(environ|cmdline|maps|fd)|root[\/\\]\.(bash_history|ssh)|\.git[\/\\]config|\.aws[\/\\]credentials|\.ssh[\/\\](id_rsa|authorized_keys)|wp-config\.php|\.htpasswd|\.netrc|\.pgpass)|(\.\.[\/\\]){2,}[^\s"'`]{0,40}\.env\b)
      description: 'Access to known sensitive files (credentials, config, keys). v3 is a strict subset of v2: the bare `[\/\\]\.env` alternative (42 of v2''s 65 benign hits) now requires a 2+ level traversal in front, because `./.env`, `assets/.env.example`, `~/.env` and `docker compose --env-file ../.env` are how every project documents and wires its own configuration.'
    - field: tool_args
      operator: regex
      value: (\{\{[^{}]{0,120}((config|self|request)\s*[\.\[]\s*\\?['"]?_|__class__|__builtins__|__import__|lipsum|cycler|joiner|namespace)[^{}]{0,120}\}\}|\$\{[^{}]{0,100}(Runtime|ProcessBuilder|getClass|forName)[^{}]{0,100}\}|<%[^%]{0,120}(Runtime|exec|system|eval)[^%]{0,120}%>)
      description: 'Server-side template injection (Jinja2, Java EL, JSP). v3 is a strict subset of v2: v2''s unbounded lazy `.*?` gaps let a match start at a JavaScript template literal (`${config.name}`) and run forward across a whole JSON-encoded document until it found the literal word "exec" and any later closing brace — 349 of its 372 benign hits came from the `pre-tool-json-arg` shape for exactly that reason. The gaps are now brace-bounded and length-bounded, and `exec` is dropped from the `${...}` branch (Java EL RCE still matches on Runtime / ProcessBuilder / getClass / forName). `config` / `self` / `request` also have to be followed by an attribute access into a dunder — bare `{{ github.event.pull_request.title }}`, `{{config_file}}`, `{{ config(materialized=''view'') }}` (dbt) and `{{.Config.User}}` (Docker Go template) are template placeholders, not Jinja2 sandbox escapes.'
    - field: tool_args
      operator: regex
      value: (?i)(O:\d+:\s*"|a:\d+:\s*\{|rO0ABX|aced0005|\{\s*"__type"\s*:|yaml\.unsafe_load|pickle\.loads|unserialize\s*\(|Marshal\.load|ObjectInputStream)
      description: 'Serialized object injection (PHP, Java, Python pickle, YAML, .NET). v3 is a strict subset of v2: `{"$type":` is dropped — the W3C Design Tokens format uses `"$type"` as an ordinary schema key, so it is not evidence of .NET TypeNameHandling deserialization on its own.'
    - field: tool_args
      operator: regex
      value: (?i)(\*\)\(|\(\|\(|\(&\()[^()]{0,60}(objectClass|uid|cn|sn|userPassword|memberOf)\s*[=~<>]
      description: LDAP filter injection patterns. v3 is a strict subset of v2. v2's anchors included a bare `\)\(`, `\|\s*\(` and `&\s*\(` — `require('stripe')('sk_...')`, `sequenceS(validation)({...})` and JSX `&& (` all match — and the following `.*?` was unbounded, so it ran across a whole JSON-encoded document to find any later `mail=` / `uid=`. The gap is now paren-bounded and length-bounded, only the three genuinely LDAP-shaped anchors remain, and the English word `mail` is dropped from the attribute list.
    - field: tool_args
      operator: regex
      value: (?i)(https?|ftp|gopher|dict|ldap|tftp)://[^\s/"'<>]{0,120}(@|%40)(localhost|127\.0\.0\.1|0\.0\.0\.0|internal|intranet|corp|private)|url\s*=\s*['"]?(file|gopher|dict|ftp|ldap|tftp)://
      description: 'URL manipulation to access internal resources via @ userinfo notation or exotic protocols. v3 is a strict subset of v2: the `@host` form now has to sit inside an actual URL. v2 matched a bare `@localhost` / `@corp` / `@private` anywhere, i.e. the e-mail address `admin@localhost.com`, the npm scope `@private/auth-form` and the connection string `postgresql://user:pass@localhost:5432/db`.'
    - field: tool_args
      operator: regex
      value: (?i)(\bfind\s+/\s+-name|\bfind\s+/\s+-exec|\bxargs\s+(-\S+\s+)*(rm|sh|bash|zsh|curl|wget|chmod|chown|dd|cat|base64|nc)\b|\*\s*(;|&&|\|\|)\s*(rm|curl|wget|sh|bash|nc|cat|python|perl|tar|zip|base64)\b)
      description: Wildcard / glob combined with an actually dangerous command. v3 is a strict subset of v2. v2 fired on `\*\s*;` (44 benign hits — any `**;` in markdown or code), on a bare `\bxargs\s+` (15 hits — `find . -name "*.py" | xargs grep -l` is ordinary shell), and on `glob(...**` (ordinary globbing in application code). The chain now has to end in a destructive/exfiltrating command.
    - field: tool_args
      operator: regex
      value: (?i)(admin\s*=\s*(true|1|yes)|role\s*=\s*(admin|root|superuser|system)|is_admin\s*=\s*(true|1)|privilege\s*=\s*(elevated|admin|root|full)|permission\s*=\s*(all|\*|admin|root)|access_level\s*=\s*(admin|root|full|unlimited))
      description: Parameter pollution attempting to set admin/elevated privilege flags
  condition: any
  false_positives:
    - Agent frameworks that dynamically register tools during runtime
    - Legitimate tool discovery during agent initialization phase
    - Agents with broad tool access for administrative purposes
    - Development/testing environments with intentionally permissive tool access
    - SQL query tools receiving legitimate query parameters
response:
  actions:
    - alert
    - snapshot
    - escalate
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): block_tool(interrupt) was removed when rule_version 2 measured 1672/5352 = 31.24% benign FP, over the 2% automatic-demotion line. rule_version 3 measures 150/14157 = 1.06% (partial measurement: the tool_name conditions are not measurable on a text corpus) and is maturity experimental; its detection fingerprint is new, so until data/benign-fp-measurement.json is regenerated the gate treats it as unmeasured and the ceiling is observe. alert, snapshot and escalate are all observe-tier.'
  auto_response_threshold: high
  message_template: |
    [ATR-2026-012] Unauthorized tool call detected. Rule: ATR-2026-012. Tool: {tool_name}. Pattern: {matched_pattern}. This rule no longer blocks the tool; it alerts and snapshots. The hook may still deny on severity — see docs/RESPONSE-ACTION-ELIGIBILITY.md.
confidence: 81
wild_validated: 2026/04/08
wild_samples: 53577