Framing-Gap Indirect Prompt Injection Bypass in Tool-Using Agents

Technical Analysis

The attack exploits instruction/data confusion in tool-using agents: attacker-controlled web content consumed by the agent contains a secret-exfiltration instruction disguised as benign-looking structural elements (an 'integrity signature,' config field, or look-alike trusted host) rather than an overt command. This reframing bypasses surface-level refusal behavior without needing to defeat the model's underlying safety alignment, as shown by an ablation where removing the confidentiality policy barely changed reframed-attack success rates. The entry point is any external content ingested by the agent (web pages, tool outputs) during a task where it holds a secret and has tool-calling capability to exfiltrate it; the attacker gains exfiltration of the secret via the agent's own legitimate tool-use capability. The paper further shows that channel separation, output-normalizing guards, and a fine-tuned defense (SecAlign) fail to fully close the gap, while payload-blind controls (destination allow-lists, planner/reader capability separation) are effective because they do not rely on the model recognizing malicious intent.

Detection Signatures

• Tool-agent requests to newly-seen or look-alike 'trusted' hostnames not on an explicit allow-list
• Outbound requests where a payload field is labeled as an 'integrity signature', 'checksum', 'config value', or similar benign-sounding field name containing high-entropy or secret-like content
• Agent tool calls that transmit session/canary/secret values to destinations outside a known egress allow-list
• Encoded payloads (e.g., ROT13, base64) appearing in tool-call arguments or destination content, especially following ingestion of untrusted web content
• Divergence between a planner's intended action and the reader/executor's actual tool invocation destination

Remediation Steps

1. 1

   Enforce destination allow-listing

   Restrict all outbound tool calls (HTTP requests, webhooks, API calls) to a pre-approved, closed set of destinations; treat any new or look-alike domain as untrusted regardless of framing.

2. 2

   Isolate planning from content reading

   Architect agents with a capability-isolating split: a planner component that decides actions has no direct access to raw untrusted content, and a reader component that processes untrusted content has no tool-invocation privileges.

3. 3

   Do not rely on model-level refusal alone

   Treat instruction-tuned refusal behavior and fine-tuned defenses (e.g., SecAlign) as insufficient against reframed/paraphrased injections; layer payload-blind, structural controls instead of trusting semantic detection.

4. 4

   Broaden policy clauses cautiously and maintain catch-alls

   If using policy-based prompting (e.g., 'do not leak the secret in any form'), avoid narrow enumerations of prohibited channels/formats, since removing catch-all language reopened the vulnerability significantly in testing.

5. 5

   Canary and monitor secret-bearing agent sessions

   Instrument agents handling sensitive values with canary tokens and monitor all tool-call payloads and destinations for exfiltration patterns, including encoded or field-relabeled variants.

6. 6

   Red-team with reframing techniques, not just overt injections

   Extend adversarial testing beyond direct injection phrasing to include template-based reframings (fake integrity checks, config fields, spoofed trusted hosts) since these are cheap to reuse and highly effective.