SHRIKETool poisoning
Tool poisoning hides instructions inside a tool’s description or schema, text an AI agent reads as trusted metadata. When the agent loads the tool, the hidden instructions steer its behavior: exfiltrate what you read, call this other endpoint, ignore prior rules. The human never sees it, because tool metadata renders to the model, not the user.
Poisoning exploits an asymmetry: humans review a tool's function, models read its full text. A description can be helpful for its first two sentences and hostile in its third. The defense is mechanical rather than judgmental: screen every tool definition before the agent sees it, at every connect, since a definition can change after initial review (see rug pull).
Related
Shrike governs AI agent actions in real time: every command, query, and tool call evaluated against policy before it executes. Start with what is action governance or the quickstart.