The Tool Said So

The injection is not in the prompt or the corpus. It comes back in the response from an integration the agent trusts. Find where the agent stopped treating tool output as data, and make it stop obeying its own tools.

Advanced · Several moving parts — expect trade-offs and a wrong turn or two.

Outcome · Detect and contain malicious instructions returned inside a tool response.

Launch the linux desktop Open the workbench only How this is graded

George · 5 lines

Roles

• AI security engineer

• SOC analyst

Standards mapping

NICE T0258

ATLAS AML.T0051, AML.T0051.001

OWASP LLM01, LLM05

Publish gate

Manifest valid · release 1.0.0

AI connection

This activity runs entirely on the deterministic runtime. Optional live-model runtimes only affect dialog, coaching and wording — never checks or scoring.

Deterministic simulationmode 0

Nothing leaves the browser session.

Chrome built-in AImode 1

Prompts never leave the learner's machine.

Bring your own keymode 2

Lab prompts reach the learner's chosen provider only.

Organization-owned AImode 3

Customer tenancy; Cybrary sees metadata only.

Cybrary-managed AImode 4

Cybrary AI gateway; retention off by default.

Hybrid routingmode 5

Per-job — the router never sends restricted jobs off-tenant.

Lab manifest

The machine-readable release contract. Authors edit this; the console refuses to publish without checks, both regression suites and a reference solve.

schemaVersion: cybrary.ai-lab/v1
id: the-tool-said-so
release: 1.0.0
mode: ai-range
maturity: 3
roles:
  - ai-security-engineer
  - soc-analyst
outcomes:
  niceTasks:
    - T0258
  atlasTechniques:
    - AML.T0051
    - AML.T0051.001
  owaspRisks:
    - LLM01
    - LLM05
aiAssets:
  models:
    - support-agent-model@2026.06
  prompts:
    - the-tool-said-so-system-prompt@1
  agents:
    - support-agent-orchestrator@3
  tools:
    - crm.lookup
    - ticket.update
    - email.send
    - refund.issue
  corpora:
    - support-kb@v4
enterpriseTopology: support-enterprise-v3
scenario:
  seed: the-tool-said-so-seed-1
  injects:
    - the-tool-said-so-inject-1
telemetry:
  requiredSignals:
    - ai.trace
    - rag.retrieval
    - tool.call
    - identity.auth
    - dlp.egress
    - siem.alert
evaluation:
  deterministicChecks:
    - the-tool-said-so-checks
  repeatedTrials: 20
  maliciousSuite: the-tool-said-so-attack-v1
  benignSuite: support-utility-v4
safety:
  networkEgress: deny
  maxTokens: 250000
  maxCostUsd: 20