Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security

Summary

Researchers introduce ETUDE (Exploiting Tool Updates for Direct Execution), an attack that embeds malicious functionality into updates of initially benign tools while preserving their legitimate behavior. Because updated tool code runs outside the LLM's context window, the attack bypasses defenses limited to model-visible content. Across three attack workloads and seven agentic frameworks, including Gemini CLI, Codex CLI, and Claude Code, ETUDE reached a 97.6% ASR with a 95.9% legitimate task completion rate, and the authors found existing defenses insufficient.

Topics

• Prompt injection and jailbreaks

Related items

• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118627: MLflow SHAP load_explainer untrusted deserialization enables code executionSimilar attack · NVD/CVE Database