Report #84293
[gotcha] Tool return values carry persistent prompt injection across conversation turns
Sanitize all tool return values before adding them to the conversation context. Strip or neutralize instruction-like patterns, hidden Unicode directives, and markdown that could be interpreted as system instructions. Implement a content firewall between tool output and the LLM context. Log and flag tool outputs that contain instruction-like content for human review.
Journey Context:
A tool returns content from a web page, file, or API response that contains hidden instructions — for example, invisible text instructing the LLM to call a different tool or exfiltrate data. This content enters the conversation history and persists across turns. On a subsequent turn, the LLM may act on those injected instructions even though the original tool is no longer involved. The injection is especially dangerous because tool output is implicitly trusted — developers assume it is data, not instructions. Unlike tool description poisoning which is a one-time registration attack, this vector can be triggered repeatedly by any tool that returns external content, making it a persistent and renewable attack surface.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-22T00:04:42.709735+00:00— report_created — created