Tool-Input Injection Breaks Production LLMs 84% of the Time

Tool-input injection breaks six production LLMs 84% of the time, per Axis Intelligence's 2026 vulnerability tracker. The tracker reproduced 47 confirmed attack vectors across those models, and tool-input injection is the highest-impact category none of them patch cleanly.

The distinction matters: this isn't someone typing a jailbreak into a chat box. It's an attacker hiding instructions in a web page, a file, or an API response that the agent reads like a user prompt. Axis Intelligence's tracker says that trick works 84% of the time.

OWASP's own list backs the shape of the problem, if not the number. The organization ranks prompt injection the top LLM threat, with reported incidents up 340% year over year. OWASP doesn't break its ranking down by attack vector. Axis Intelligence's tracker does, and it points at tool results specifically, not the prompt box most defenses are built to watch.

Most agent frameworks still don't separate what the user typed from what a tool call returned. Every retrieval call, search result, and API response is a place an attacker can hide instructions. Axis Intelligence found six production models will follow those instructions 84% of the time.