ShrikeTool poisoning
Tool poisoning hides instructions inside a tool’s description or schema, text an AI agent reads as trusted metadata. When the agent loads the tool, the hidden instructions steer its behavior: exfiltrate what you read, call this other endpoint, ignore prior rules. The human never sees it, because tool metadata renders to the model, not the user.
Poisoning exploits an asymmetry: humans review a tool's function, models read its full text. A description can be helpful for its first two sentences and hostile in its third. The defense is mechanical rather than judgmental: screen every tool definition before the agent sees it, at every connect, since a definition can change after initial review (see rug pull).
Related
Shrike governs AI agent actions in real time: every command, query, and tool call evaluated against policy before it executes. Watch an agent get refused in the playground, where every tool call is scanned for real, or read what is action governance.