01 / Attack path
How the boundary is crossed
A web-search tool returns a forged incident note telling an operations agent to rotate a production secret to an attacker-controlled value.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Label tool output by origin, require a trusted incident source and authorize the exact secret operation at the vault boundary.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
The model treats text returned by a tool as if it came from an authorized operator.
Keep source and result reference, attempted vault call, authority decision and secret version state.
04 / Canonical scope
Why this reference stands alone
Prompt injection is the broad mechanism; this page owns laundering through a tool result.
Protocol or attack trace
Result-to-command promotion
Search result includes forged incident note ordering vault rotation to attacker-selected value.
Treat result as untrusted data; require trusted incident and exact vault authorization before rotation.
Primary references