A housing casework agent follows a poisoned tool description that directs it to post case notes to an external URL. What risk does this illustrate?
Select an answer to reveal the explanation.
Short Explanation
If the tool’s description says “send notes here” and “here” is an attacker’s URL, the agent may obediently comply. Treat tool metadata like untrusted instructions, not gospel. Poisoned descriptions are prompt injection wearing a tool badge.
Full Explanation
A housing casework agent that follows a poisoned tool description directing it to post case notes to an external URL illustrates malicious tool metadata or description attacks that steer agent behavior. Tool schemas, names, and natural-language descriptions are instruction surfaces the model may treat as authoritative. In municipal housing workflows, attackers or compromised registries that inject exfiltration directives into tool metadata can turn legitimate case-note tools into data-theft channels without changing the agent’s primary prompt.
Normal RAG chunking of public housing ordinances fails by concept: retrieving published ordinances is expected knowledge retrieval, not adversarial tool metadata that redirects case notes off-platform. Safe use of temperature settings during case summarization addresses sampling randomness, not poisoned tool descriptions that redefine where outputs are sent. Routine certificate rotation for the municipal email gateway is PKI hygiene and does not explain an agent obediently posting notes to an attacker-controlled URL because a tool description told it to.
Exam caveat: tool-description attacks are a form of indirect prompt/instruction injection via the tool catalog; pinning trusted tool manifests, signing tool metadata, and human review of new tools reduce—but do not eliminate—risk if the agent still trusts free-text description fields over policy. Operational check: treat tool catalogs as privileged configuration; review description diffs before promotion, block unexpected outbound destinations for case-note tools, and run a red-team test that injects an external URL into a staging tool description to confirm the housing agent refuses or is blocked by egress controls.