Guided security lab

Tool Output Injection

A guided exercise on the response side of tool use: separate trust in a tool from trust in what it returns, keep field provenance, and treat every follow-on tool, destination or action as a new authorization decision.

Conceptual simulationAdvanced15 minutes2026-09-26

Conceptual simulation

This exercise uses authored, deterministic examples with fictional names and neutral synthetic content. It calls no tools, APIs, connectors, agents or models, and it does not predict how any real model behaves.

Step 3 of 63/6

Learning objectives

Separate trust in the tool component from trust in returned content and individual fields.
Separate request-side call authorization from response-side result handling.
Explain why a valid schema, a 200 OK status or an internal connector does not establish semantic or instruction authority.
Preserve source and field-level provenance through parsing, normalization and context assembly.
Recognize cross-tool influence without letting the output of one tool authorize another tool, resource or destination.
Treat model and sub-agent proposals as requests that need independent authorization, destination and flow checks.
Allow bounded, read-only use of legitimate tool results when scope and provenance align, without granting instruction authority.

Prerequisites

Trust Boundaries and Model Context lab (recommended)
RAG Prompt Injection lab (recommended)

Choose a scenario

Each fictional scenario begins after an authorized tool call. It shows the returned content the model sees and, separately, the tool, grant, authorship, lineage and policy facts the application records. Reliance decisions belong to the application facts.

Trusted connector, untrusted fieldAn internal ticket connector is authorized to read one synthetic ticket. One free-text field was written by an external requester and tries to redirect the workflow to an unrelated task. The model proposes following it.Valid schema, free-text descriptionAn order API returns valid JSON that matches the expected schema with 200 OK. Its free-text description field suggests sending the record to a new external destination. The model proposes doing so.Bounded read-only use of a customer noteA trusted support tool returns a synthetic note written by the customer. The user asked only for a read-only summary of that record. The model proposes an attributed summary with no follow-on action.Tool A result suggests a Tool B callA calendar tool is legitimately called and returns an event note suggesting a file-sharing call against a different folder and recipient. The model proposes that call with concrete parameters.Sub-agent returns an attributed synthesisA research sub-agent performed a permitted read-only lookup and returns a source-attributed synthesis. The parent agent is asked for a read-only answer within the same task. No send, change or egress is proposed.

Tool result path and trust flow

An authorized call returns a result, the application parses it with field provenance, the model proposes a next step and policy decides the effect. Tools and gates are system components; returned content and proposals stay variable.

Ticket connector (authorized read)System component->
Returned ticket recordVariable content->
Parser with field provenanceSystem component->
ModelSystem component->
Updated planVariable content->
Task and action policySystem component

Model-visible tool result content

Returned fields the model reads. Bracketed text marks neutral synthetic content, not a real instruction.

Ticket T-204, field: status
Open
Ticket T-204, field: requester_comment
[synthetic instruction-like text attempting to redirect the workflow]

Application-side evidence

Recorded by the tool registry, grant store, parser, lineage records, ACL and destination policy outside model text.

Tool identity: tickets-connector v3, internal, registered
Call authorization: Read of T-204 for the initiating agent on behalf of the signed-in support user
Field authorship: status: set by the ticket system; requester_comment: written by an external requester
Task scope: Summarize the current status of T-204, read-only