Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning

The integration of external tools has substantially expanded the capabilities of large language model (LLM) agents, but it also introduces new attack surfaces beyond prompt injection. In particular, cross-tool description poisoning can manipulate planner-visible tool metadata to steer an agent’s trajectory, even if the poisoned tool itself is never chosen. To understand the effectiveness of existing defenses against this emerging threat, we first evaluate several prompt-injection defenses and find that they transfer poorly to cross-tool description poisoning. A key observation is that poisoned descriptions persist in the planning context across steps, enabling continuous influence over subsequent tool choices. Building on this insight, we propose Tool-Guard, a novel system-level defense based on a new concept called isolated planning, in which tool invocations that are detected as misaligned or suspicious cause the corresponding tool to be placed in a quarantined list (the influenced list), breaking further influence from poisoned descriptions. With this influence isolated, the tool can continue to be used to support the task, enabling a robust defense that preserves legitimate tool utility. Experiments on the AgentDojo and ASB benchmarks show that Tool-Guard substantially reduces attack success while maintaining high task utility. Our code is available at https://github.com/shishishi123/Tool-Guard.

Modern AI agents can use external tools, such as email, calendars, banking services, or web APIs, to complete complex tasks for users. Before using these tools, the agent reads short tool descriptions to decide which tool to call and how to use it. We show that these descriptions can become a hidden security risk because an attacker can poison the description of a seemingly harmless tool and trick the agent into performing a dangerous action with another, more sensitive tool, even if the poisoned tool is never used. To defend against this threat, we build Tool-Guard, a system that checks each planned tool action before it is executed. When Tool-Guard detects a suspicious or poorly justified action, it separates potentially influenced tools from the rest and asks the agent to replan under isolated tool contexts. This helps cut off malicious influence while still keeping useful tools available. Our experiments on two agent security benchmarks show that Tool-Guard greatly reduces attack success while preserving normal task performance. This work shows that tool descriptions are an important attack surface that future AI agents need to protect.