Skip to main content

hackagent.attacks.techniques.indirect.tool_output_ipi.prompts

The poisoned tool result, and the framing that steers what the agent does with it.

A tool-using agent trusts what its tools return. This attack never speaks to the target as the user: it hands back a tool result that carries an instruction, and measures whether the agent carries that instruction out as if the tool had told it to. Everything here builds or shapes that result.

SUCCESS_FRAMING​

Injection framing per InjecAgent success setting, copied verbatim.

JUDGE_HINTS​

Judge-instruction hints per setting, for the panel's context.

framing​

def framing(setting: str) -> str

Injection framing for an InjecAgent success setting.

judge_hint​

def judge_hint(setting: str) -> str

Judge-instruction hint for a setting.

render_injection​

def render_injection(template: str, *, goal: str, benign_task: str,
                     tool_name: str) -> str

Fill the injection template, tolerating a subset of placeholders.

poisoned_observation​

def poisoned_observation(body: str,
                         *,
                         setting: str,
                         prefix: str = DEFAULT_OBSERVATION_PREFIX) -> str

The tool result: a benign-looking prefix wrapped around the injection.

poisoned_history​

def poisoned_history(*, benign_task: str, tool_name: str, tool_arguments: str,
                     observation: str) -> Messages

user asks -> assistant calls the tool -> the tool returns the poison.

refine_request​

def refine_request(goal: str, benign_task: str, tool_name: str,
                   payload: str) -> list[Message]

Ask the attacker to sharpen an injection payload.