mlsanityData to 14 Oct 2026

ToolTweak: An Attack on Tool Selection in LLM-based Agents

arXiv 2510.02554 ↗First posted 2 Oct 2025cs.CR cs.AIcited by 26

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

As LLMs increasingly power agents that interact with external tools, tool use has become an essential mechanism for extending their capabilities. These agents typically select tools from growing databases or marketplaces to solve user tasks, creating implicit competition among tool providers and developers for visibility and usage. In this paper, we show that this selection process harbors a critical vulnerability: by iteratively manipulating tool names and descriptions, adversaries can systematically bias agents toward selecting specific tools, gaining unfair advantage over equally capable alternatives. We present ToolTweak, a lightweight automatic attack that increases selection rates from a baseline of around 20% to as high as 81%, with strong transferability between open-source and closed-source models. Beyond individual tools, we show that such attacks cause distributional shifts in tool usage, revealing risks to fairness, competition, and security in emerging tool ecosystems. To mitigate these risks, we evaluate two defenses: paraphrasing and perplexity filtering, which reduce bias and lead agents to select functionally similar tools more equally. All code will be open-sourced upon acceptance.

Key facts. Cited by 26 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 28 of its 46 references that are in the map. First posted on arXiv 2 Oct 2025.

Builds on

28 of 46 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  2. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul

Other references · 26

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2024The Llama 3 Herd of Modelscited by 14,715
  4. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  5. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  6. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  7. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
  8. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  9. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
  10. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  11. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  12. 2023Gorilla: Large Language Model Connected with Massive APIscited by 1,332
14 more
  1. 2024LLM Evaluators Recognize and Favor Their Own Generationscited by 686
  2. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  3. 2024DeepSeek LLM: Scaling Open-Source Language Models with Longtermismcited by 642
  4. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  5. 2023Detecting Language Model Attacks with Perplexitycited by 431
  6. 2024Justice or Prejudice? Quantifying Biases in LLM-as-a-Judgecited by 368
  7. 2023Tool Learning with Foundation Modelscited by 302
  8. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
  9. 2023Challenges and Applications of Large Language Modelscited by 254
  10. 2023From Sparse to Soft Mixtures of Expertscited by 248
  11. 2024Best-of-N Jailbreakingcited by 76
  12. 2024ToolGen: Unified Tool Retrieval and Calling via Generationcited by 74
  13. 2025Adversarial Paraphrasing: A Universal Attack for Humanizing AI-Generated Textcited by 17
  14. 2025BiasBusters: Uncovering and Mitigating Tool Selection Bias in Large Language Modelscited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 24.

26 papers.

Sort:

By area:

  1. 2026Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystemscited by 45
  2. 2026AgentWorm: Self-Propagating Attacks Across LLM Agent Ecosystemscited by 17
  3. 2026When Tools Fail: Benchmarking Dynamic Replanning and Anomaly Recovery in LLM Agentscited by 17
  4. 2026MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCPcited by 14
  5. 2026When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agentscited by 13
  6. 2026LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarioscited by 9
  7. 2025Toward a Safe Internet of Agentscited by 6
  8. 2026From Anatomy to Smells: An Empirical Study of SKILL.md in Agent Skillscited by 6
  9. 2026Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screeningcited by 5
  10. 2026Intent-Governed Tool Authorization for AI Agentscited by 5
  11. 2026Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planningcited by 3
  12. 2025Can LLMs Threaten Human Survival? Benchmarking Potential Existential Threats from LLMs via Prefix Completioncited by 1
14 more
  1. 2026ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Coveringcited by 1
  2. 2026ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systemscited by 1
  3. 2026Agent-Facing Information Design in LLM Tool Registriescited by 0
  4. 2026Do LLMs Favor Their Providers? Measuring Vertical Integration Bias in Code Generationcited by 0
  5. 2026A Security Analysis of Long-Horizon Agentic AI Systems: Threats, Evaluation, and Framework Developmentcited by 0
  6. 2026Know Your Agent: Reconnaissance-Driven Pentesting of AI Agentscited by 0
  7. 2026MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Appscited by 0
  8. 2026WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agentscited by 0
  9. 2026ContextLeak: Exfiltrating LLM Agent Context via Malicious Toolscited by 0
  10. 2026Implicit Manipulation for Skill Selection in LLM Agents with Semantic Matchingcited by 0
  11. 2026SINGED: Correct Outputs Do Not Certify Safe Execution in LLM Agentscited by 0
  12. 2026Surviving the Router: Optimizing Skill Injections for Retrieval and Executioncited by 0
  13. 2026Which Metadata Matters for LLM Tool Selection in MCP? Evidence from Controlled Factor-Level Interventionscited by 0
  14. 2026Same Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety Classifierscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026ChainFuzzer: Greybox Fuzzing for Workflow-Level Multi-Tool Vulnerabilities in LLM Agents
  2. 2025Les Dissonances: Cross-Tool Harvesting and Polluting in Pool-of-Tools Empowered LLM Agents
  3. 2025Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools
  4. 2026MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning
  5. 2026Extracting Knowledge from Tools in LLM Agents
  6. 2026Agents Trust Tools Too Much: Measuring Reliance on Unreliable Tools
  7. 2025Tool Preferences in Agentic LLMs are Unreliable
  8. 2026MalTool: Malicious Tool Attacks on LLM Agents