Newest papers

SEAL: Towards Persistent Tool Poisoning Attack against LLM Agents via Prefix-Eliciting Trigger

Nanjun Zhou, Yiming Li, Yukun Chen, Ting Qiao, Enhao Huang, Zhan Qin · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25372 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Los potenciales envenenadores de herramientas han surgido como una amenaza de seguridad crítica para los agentes de LLM, donde los adversarios incorporan instrucciones maliciosas en las descripciones de herramientas o recursos externos que entran en el contexto del agente objetivo, lo que permite a los adversarios manipular el proceso de selección de herramientas del agente. Sin embargo, los ataques de envenenamiento de herramientas existentes se basan principalmente en una suposición idealizada de que los ataques tienen un efecto de tarea dentro de una sola ronda de interacción. Mostramos que su eficacia se degrada drásticamente en configuraciones de agentes realistas multi-campos. También revelamos que esta degradación proviene del hecho de que los agentes no superficialmente atacan señales relevantes en su razonamiento contextual a medida que el contexto de

Machine translation (Meta M2M100); the English original follows.

Abstract

Tool poisoning has emerged as a critical security threat to LLM agents, where adversaries embed malicious instructions in tool descriptions or external resources that enter the agent's context, allowing adversaries to manipulate agent's tool selection process. However, existing tool poisoning attacks primarily rely on an idealized assumption that the attacks task effect within a single interaction round. We show that their effectiveness degrades sharply in realistic multi-round agentic settings. We further reveal that this degradation stems from the fact that agents do not consistently surface attack-relevant signals in their reasoning as the planning context evolves, thereby weakening the attack's influence across rounds. To investigate whether tool poisoning remains a practical threat in such realistic settings, we propose SEAL, a two-stage method for persistent tool poisoning. Specifically, SEAL first performs Prefix-Eliciting Trigger Optimization (PETO) to optimize context-specific triggers that elicit attack-relevant reasoning prefixes, improving effectiveness within individual contexts. It then applies Local-to-Universal Trigger Aggregation (L2U) to combine these local triggers into a single universal trigger, improving generalization across different contexts and execution rounds. Extensive experiments across seven representative multi-round scenarios and different models demonstrate the attack effectiveness of SEAL, its transferability across target models, and its resistance to potential defenses.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Context (archaeology), Task (project management), Transferability, Computer security, Generalization

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange