Tool Call Forgery
Tool call forgery is a prompt injection technique in which untrusted content imitates the format an agent uses to call its tools or to receive their results, so that the model believes a tool has been invoked, has returned a value, or should be invoked next. It targets agents that can act, not just answer, and is how an injection turns into a file deletion or a payment.
Agents talk to their tools in structured text: a JSON block that names a function and its arguments, a tagged section that carries the result back. A model that has seen thousands of those exchanges learns their shape, and an attacker who knows the framework can write content that looks exactly like one. The document says, in effect, “the search tool has already returned this result” or “the next required action is send_email with these parameters”.
The forgery works because the model has no channel-level way to distinguish a real tool result from a quoted one. If the content is passed to the model as text, the fake result is as convincing as a genuine one, and the model reasons from it. Frameworks that mark tool output with special tokens or separate message roles reduce the risk; content that is fetched and stuffed into a user message does not benefit.
Defensively, the pattern is detectable: function-call syntax, role markers, or a framework’s delimiters appearing inside a web page or an e-mail are anomalous by nature. Flagging them before the model reads the content prevents the forged call from being reasoned about at all.
Example
A travel agent fetches a hotel’s page to check availability. Embedded in the page is a block formatted like the agent’s own tool protocol, reporting that the booking tool has succeeded and asking the model to confirm a charge of a much larger amount to the user. The agent’s next message to the user reads as a confirmation.
In isMalicious
tool_call_forgery and role_system_markers are two of the gate’s detection families: they match function-call syntax, role labels and framework delimiters inside scanned content, and a hit is returned with its span by POST /api/gate/scan or the MCP tool scan_before_use so the agent framework can refuse the document before the model sees it.
Frequently Asked Questions
What is Tool Call Forgery?
Tool call forgery is a prompt injection technique in which untrusted content imitates the format an agent uses to call its tools or to receive their results, so that the model believes a tool has been invoked, has returned a value, or should be invoked next. It targets agents that can act, not just answer, and is how an injection turns into a file deletion or a payment.
How is Tool Call Forgery related to Prompt Injection?
Tool Call Forgery and Prompt Injection are both key concepts in threat intelligence. Prompt injection is an attack on a system built around a language model in which text supplied as data (a web page, an e-mail, a document, a tool result) is written so that the model reads it as instructions. The model then does what the text says instead of what its operator intended: leaking data, calling tools, or changing its answer.
Related Terms
Prompt Injection
Prompt injection is an attack on a system built around a language model in which text supplied as data (a web page, an e-mail, a document, a tool result) is written so that the model reads it as instructions. The model then does what the text says instead of what its operator intended: leaking data, calling tools, or changing its answer.
Instruction Override
Instruction override is the prompt injection technique that tells the model to discard what it was told before: “ignore all previous instructions”, “your new task is”, “disregard the system prompt”, “you are now in developer mode”. It is the most recognisable injection family and the one heuristic scanners catch first, which is why real attacks paraphrase it.
Put this intelligence to work
Query indexed indicators — IPs, domains, URLs, and hashes — in seconds.