Sponge Tool Attack: Stealthy Denial-of-Efficiency against Tool-Augmented Agentic Reasoning

Enabling large language models (LLMs) to solve complex reasoning tasks is a key step toward artificial general intelligence. Recent work augments LLMs with external tools to enable agentic reasoning, achieving high utility and efficiency in a plug-and-play manner. However, the inherent vulnerabilities of such methods to malicious manipulation of the tool-calling process remain largely unexplored. In this work, we identify a tool-specific attack surface and propose Sponge Tool Attack (STA), which disrupts agentic reasoning solely by rewriting the input prompt under a strict query-only access assumption. Without any modification on the underlying model or the external tools, STA converts originally concise and efficient reasoning trajectories into unnecessarily verbose and convoluted ones before arriving at the final answer. This results in substantial computational overhead while remaining stealthy by preserving the original task semantics and user intent. To achieve this, we design STA as an iterative, multi-agent collaborative framework with explicit rewritten policy control, and generates benign-looking prompt rewrites from the original one with high semantic fidelity. Extensive experiments across 6 models (including both open-source models and closed-source APIs), 12 tools, 4 agentic frameworks, and 13 datasets spanning 5 domains validate the effectiveness of STA.

Modern AI assistants can use external tools, such as search engines, calculators, or code interpreters, to solve complex tasks more effectively. However, these tool-using systems also introduce a new risk: a malicious user may not need to break the model or modify its tools, but can instead slightly rewrite a normal-looking question so that the assistant performs much more unnecessary work. In this paper, we study this problem and introduce Sponge Tool Attack, a method that rewrites user prompts while preserving their original meaning. The rewritten prompts still ask for the same task, but they can make the AI agent take longer reasoning paths and call more tools before reaching an answer. We evaluate this risk across multiple language models, tools, agent frameworks, and datasets. Our results show that tool-using AI agents can become substantially less efficient while still appearing to behave normally. This suggests that future AI agent systems should be designed not only for accuracy, but also for cost-aware and efficiency-aware safety.