Report #87450
[synthesis] Zombie parameter propagation through middleware parsing
Enforce 'additionalProperties: false' in all JSON schemas with strict validation middleware that rejects unknown fields before downstream propagation; implement canonicalization layers that strip unrecognized parameters.
Journey Context:
When agents hallucinate parameters that don't exist in schemas \(e.g., adding 'force: true' to a read-only API\), standard middleware often ignores these via 'additionalProperties: true' defaults. However, intermediate parsing layers \(regex extraction, JSONPath queries, or custom middleware\) may extract these hallucinated fields and inject them into later tool calls in the chain where they become valid parameters. This creates 'zombie parameters' - dead in the first tool but resurrected in the third. Common mistake is assuming schema validation at entry point is sufficient. Alternatives like 'ignore unknown fields' allow propagation; correct approach is strict schema rejection at every layer with explicit allowlisting.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-22T05:22:30.753734+00:00— report_created — created