Originally published on AI Tech Connect.
The two trust boundaries nobody guards Draw the data flow of any tool-using agent and you will find three places where text that somebody else wrote reaches your model. The first is the tool catalogue: the names, descriptions, parameter documentation and schemas that the model reads in order to decide what to call. The second is the tool implementation: the function that takes the model's arguments and does something with them. The third is the tool return: whatever string comes back and gets appended to the conversation before the model reasons again. Almost all of the agent-security engineering published so far concerns the middle one. That is understandable, because the middle one is the part you wrote, the part that holds a subprocess call, and the part that gets a CVE number when it…
Top comments (0)