Tool Selection & Action Hijacking

• Tool Selection and Action Hijacking is a vulnerability in LLM agents where tool metadata manipulation enables adversarial interference with intended tool calls.
• It involves a two-stage process of retrieval and selection, where attackers optimize tool descriptions to dramatically increase unauthorized invocation rates.
• Defensive measures include metadata normalization, perplexity filtering, and runtime guardrails, yet robust solutions remain an open research challenge.

Tool selection and action hijacking refer to the processes and vulnerabilities by which LLM-based agents, and related AI systems, decide which external tool or function to invoke in response to a user request, and the corresponding capacity for adversarial manipulation to subvert that process. As LLM-powered agents integrate increasingly complex tool ecosystems—via natural language tool catalogs, embedding-based retrieval, or structured API registries—the tool-selection mechanism serves as both a functional bottleneck for capability and a high-severity attack surface. Action hijacking encompasses all adversarial methods that cause the agent to select and/or execute tools or function calls not originally intended or authorized by the user, leading to security, fairness, or integrity failures.

1. Tool Selection in LLM-Based Agents: Mechanisms and Formalization

In LLM-based agentic frameworks, every tool $t$ is registered with metadata—typically a natural-language name $p_n$ and description $p_d$—alongside a parameter schema $p_p$ assumed to be correct and fixed (Sneh et al., 2 Oct 2025). On receiving a user query $q$, the agent presents the LLM a context of the form $$p_\text{sys} \circ f_\text{def}(\mathcal{T}) \circ q$$, where $f_\text{def}$ serializes all tool definitions for the set $\mathcal{T}$. The LLM then generates a “tool call” $f_\text{call}(t)$, typically treated as a stochastic selection:

$$P_\text{LLM}( f_\text{call}(t) \mid p_\text{sys} \circ f_\text{def}(\mathcal{T}) \circ q )$$

In retrieval-augmented frameworks, tool selection is further decomposed into a two-stage pipeline:

• Retrieval: A retriever ranks the global tool pool $p_n$0 (which may be very large, $p_n$1), returning the top-$p_n$2 candidates $p_n$3 for user intent $p_n$4 based on a score $p_n$5, often using cosine similarity in embedding space (Yeon et al., 5 Oct 2025, Shi et al., 28 Apr 2025).
• Selection: The LLM selects one tool from $p_n$6, using only the provided metadata (name, description, privilege level) and associated prompts.

In function-calling LLMs (MCP, API registry), tool selection reduces to predicting the function $p_n$7 in

$p_n$8

where $p_n$9 encodes the full prompt sequence (Belkhiter et al., 22 Apr 2026).

2. Attack Surfaces and Action Hijacking Methodologies

Action hijacking exploits the tool-selection process by leveraging the fact that tool descriptions and names—often unmoderated or weakly verified—directly influence both retrieval and selection outcomes. Recognized attack vectors include:

• Metadata Manipulation: Adversaries modify only the name and description $p_d$0 of a chosen tool $p_d$1, iteratively seeking $p_d$2 that maximizes selection rate $p_d$3 over a query set $p_d$4; “ToolTweak” is emblematic, consistently driving selection rates from 20% to 81% and inducing one-hot concentration in the tool-usage distribution (Sneh et al., 2 Oct 2025).
• Black-box and Gradient-free Optimization: Attacks proceed even with only black-box access to the agent, via greedy or LLM-guided search over perturbations, observing empirical selection rates and iteratively refining metadata (Chen et al., 7 Apr 2025, Belkhiter et al., 22 Apr 2026).
• Fine-grained and Universal Function Hijacking: The “Function Hijacking Attack” (FHA) targets individual function descriptions to subvert the model’s preference, robustly across queries and payloads, using a cosine-gradient-greedy (GCG) loop. Universal variants optimize a single poisoned description to hijack tool selection for multiple prompts and tool menus, achieving attack success rates (ASR) of 70–100% (Belkhiter et al., 22 Apr 2026).
• Retrieval-layer Manipulation: Attacks such as ToolFlood populate the tool library with a small set of adversarial tools, strategically distributing their embeddings to “cover” the embedding space such that, for all plausible queries, only attacker-controlled tools are returned in top-$p_d$5 retrieval—effectively denying visibility to benign tools, with top-$p_d$6 domination rates up to 97% (Jawad et al., 14 Mar 2026).
• Structured Template and Protocol Manipulation: Sophisticated attacks like Phantom inject structured tokens (e.g., chat delimiters, pseudo-role markers) into retrieved content, causing the LLM’s context parser to misinterpret injected content as legitimate tool calls or user instructions—bypassing semantic alignment and exploiting architectural trust boundaries (Deng et al., 18 Feb 2026).
• Prompt Injection, RAG-Layer Hijacking, and Chaining: Prompt injection either directly biases selection (e.g., ToolHijacker (Shi et al., 28 Apr 2025)) or, in RAG-based architectures, uses retrieval-adversarially crafted queries to surface “gadgets” (action-aware knowledge), enabling indirect hijack of the agent’s planning logic (Zhang et al., 2024).

3. Empirical Analyses and Taxonomy of Hijack Consequences

Selection Rate Manipulation

“ToolTweak” demonstrates through direct empirical evaluation that minimal tweaks to tool name/description can increase call rate (Best Selection Rate, BSR) from a baseline $p_d$720% up to 81.6% across a wide variety of LLM backends and tasks (Sneh et al., 2 Oct 2025). Table: Model-wise empirical results:

Model	No Attack	ToolTweak	Manual Suffix
DeepSeek Chat	20.2%	81.6%	68.7%
Gemini 2.5	18.9%	48.7%	56.1%
GPT-OSS	19.0%	73.6%	76.4%
Grok 3 Mini	19.9%	50.7%	89.5%
Llama 3.1	19.8%	34.0%	38.1%
Qwen 2.5	19.9%	45.9%	61.3%

Distributional Robustness and Saturation

The ToolCert framework quantifies tool-selection robustness under adaptive, budgeted adversaries. Clean task accuracy is $p_d$892%, but adversarial tool injection drives certified accuracy lower bounds near zero after a handful of attack rounds (e.g., 18% after a single adaptation, 0% after $p_d$9) (Yeon et al., 5 Oct 2025).

Functionality-Agnostic Hijacking and Multi-Turn Chaining

STAC demonstrates that chaining multiple benign tool calls can collectively enable a malicious final invocation (e.g., compress $p_p$0 delete $p_p$1 erase backups), with attack success rates over 90%, even when single-step defenses are in place (Li et al., 30 Sep 2025).

Code-Level Hijacking

MalTool establishes that manipulating tool invocation is only one half of the threat; embedding malicious behaviors in selected tools completes the action hijack loop. The end-to-end compromise likelihood, $p_p$2, is given by the product of installation probability, selection probability, and code-level compromise probability. Malicious behaviors are categorized according to the confidentiality-integrity-availability triad, e.g., remote exfiltration, data deletion, or resource hijacking—demonstrating 100% attack success in end-to-end tests with ASR up to 1.0 even when LLMs are safety-aligned (Hu et al., 12 Feb 2026).

4. Defense Mechanisms, Their Efficacy, and Remaining Gaps

Defense strategies cluster into the following categories:

• Paraphrasing and Metadata Normalization: Objective paraphrasing of tool descriptions substantially degrades metadata-based attacks, reducing BSR and moving D_JS (Jensen–Shannon divergence) toward uniformity, though not to baseline (Sneh et al., 2 Oct 2025).
• Perplexity Filtering: Combining perplexity (e.g., GPT-2-based) with length features enables partial identification of adversarial metadata, but is unreliable as a standalone defense due to low separation of malicious from benign (Sneh et al., 2 Oct 2025). Perplexity-based detectors applied to prompt-injection attacks experience high false-negative rates (FNR 85–100%) (Shi et al., 28 Apr 2025).
• Retrieval-Side Robustness: Hybrid retrieval approaches, diversity penalization (MMR re-ranking), and blacklisting of near-duplicate tools reduce but do not eliminate effective saturation attacks (e.g., ToolFlood ASR remains $p_p$391% with MMR reranking) (Jawad et al., 14 Mar 2026).
• Template and Protocol Hardening: Structured template augmentation, autoencoding, and Bayesian optimization can nearly saturate role-confusion attacks unless tool templates are tightly authenticated, highlighting a need for provenance and parser-side defenses (Deng et al., 18 Feb 2026).
• Description-Code Consistency Checking and Provenance Control: Automated semantic checks between tool descriptions and code, and cryptographic provenance requirements (e.g., signed tool submissions, reproducible builds) are recommended for platforms to enforce—although conventional malware detectors (VirusTotal, AntGroup) are ineffective, exhibiting very low detection rates and high false positives (Hu et al., 12 Feb 2026).
• Runtime Guardrails and Proactive Step-level Defense: Systems such as TS-Guard and TS-Flow employ proactive reinforcement-learning–trained guardrails that reason over multi-modal signals (harmlessness, attack correlation, fine-grained safety labels) at each candidate action step. Guardrails can reduce attack success rate by 65% and improve benign task completion by up to 10% under prompt injection attacks (Mou et al., 15 Jan 2026).
• Tool Result Parsing: Defensive pipelines which automatically parse and sanitize each tool result—requesting only minimal required information as defined by the LLM itself, and filtering or redacting outputs that could trigger a tool call—yield a 10$p_p$4 reduction in attack success rate, at some utility cost (Yu et al., 8 Jan 2026).
• Margin Monitoring and Activation Auditing: Given that modern LLMs encode tool selection in low-dimensional linear circuits (as revealed by mean-difference linear probes), monitoring the selection margin or activation values can preemptively flag or refuse ambiguous or easily hijacked tool calls (Wu et al., 8 May 2026).
• Chain-of-Thought and Multi-Step Context Alignment: In embodied or agentic settings, attacks on CoT reasoning (e.g., adversarial patches for VLAs) can hijack object selection and downstream actions. Defenses may involve explicit CoT-instruction consistency checks, randomized sensing, and adversarial training, though strong security remains an open frontier (Huang et al., 24 Mar 2026).

5. Theoretical Analysis and Formal Guarantees

Formal treatment of tool selection under adversarial manipulation has been advanced across several axes:

• Modeling tool selection as a Bernoulli success process, with empirical and confidence-bound–certified worst-case task accuracy under strong adaptive attackers (Yeon et al., 5 Oct 2025).
• Budgeted multi-cover and embedding-space analysis to characterize the minimum set of adversarial tools required to “cover” all target queries under a given semantic threshold (Jawad et al., 14 Mar 2026).
• Threat graph modeling and formal specification checking to enumerate the pathways from tool distribution, installation, selection, and malicious code execution, and establish security constraints (e.g., semantic description–code alignment enforced via SMT formulae or bounded model checking) (Hu et al., 12 Feb 2026).
• Identification of specific mid/late-layer attention heads driving tool selection, and demonstration of the causal efficacy of single-vector interventions in steering tool selection with high accuracy, supporting the feasibility (and risk) of white-box steering and auditing approaches (Wu et al., 8 May 2026).

6. Implications for System Design, Fairness, and Security

The convergence of empirical findings underscores critical systemic risks:

• Fairness and Competition: Automated or adversarial “SEO” of tool descriptions can enable unfair monopolization of agentic traffic, locking out functionally equivalent but less-optimized tools. Distributional shifts induced by attacks can drive usage rates from $p_p$520% to $p_p$680% for a single tool (Sneh et al., 2 Oct 2025).
• Security and Downstream Harm: Action hijacking can cause data leaks, privilege escalation, and denial of service, independent of model weights or user-level attack surfaces. Manipulation at the tool-selection or protocol layer bypasses traditional LLM prompt filters, as demonstrated by practical attacks on major API endpoints and closed-source deployments (Deng et al., 18 Feb 2026, Liu et al., 6 Sep 2025).
• Limitations and Future Challenges: No existing detection or prevention technique—whether perplexity-based, fine-tuned selection models, or alignment/spotlighting—yields robust defense under the most sophisticated attacks (Shi et al., 28 Apr 2025, Li et al., 30 Sep 2025). Prompt- or template-level attacks on context serialization and role confusion can subvert even strongly-aligned, closed-source models at industrial scale (Deng et al., 18 Feb 2026).
• Recommendations: Mitigation should combine paraphrase normalization, schema-based validation, cryptographic signing, anomaly monitoring, guardrail-driven feedback, and continual adversarial testing (e.g., ToolCert audits).

7. Open Challenges and Research Directions

• Development of robust, compositional verification bridging natural-language metadata and code-level semantics.
• Designing scalable, provenance-enforced or authenticated marketplaces for tool registration and retrieval.
• Embedding- and template-level anomaly detection that operates efficiently at the scale of real-time agentic workloads.
• Agentic simulation and fine-grained intervention tools for detecting and tracing action hijacks in complex, multi-step workflows.
• Exploration of system architectures that minimize reliance on surface-text for tool-selection, and that enforce defense-in-depth via protocol, provenance, and dynamic behavioral auditing.

The field converges on the view that effective tool selection and action hijacking prevention constitute a first-class security and reliability challenge for LLM-driven agentic systems. The exploitability of language-level, embedding-level, and protocol-level components by black-box or white-box adversaries is now established across diverse architectures, necessitating a paradigm shift in the design and deployment of tool-augmented AI (Sneh et al., 2 Oct 2025, Chen et al., 7 Apr 2025, Belkhiter et al., 22 Apr 2026, Yeon et al., 5 Oct 2025, Shi et al., 28 Apr 2025, Hu et al., 12 Feb 2026, Jawad et al., 14 Mar 2026, Mou et al., 15 Jan 2026, Deng et al., 18 Feb 2026, Zhang et al., 2024, Liu et al., 6 Sep 2025).