Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-16 · high
Validating tool outputs against source and format cut a state-corruption exploit's success rate from 84.7% to 2.3%, with benign accuracy up too.
Why now: It's timely because most agent frameworks still trust tool output without checking it, which is exactly the gap this closes.
A new arXiv paper targets a specific agent exploit. An attacker slips a poisoned response into a tool call. The bad data then corrupts what the agent does for the rest of the session. Without a check, that attack succeeds 84.7% of the time. One bad tool response can compromise a whole session, not just one answer. That matters for anyone chaining tool calls in a live agent loop.
The fix tags every tool response with its source and checks it against a field contract. Structured data gets a static schema. Open-ended content gets provenance metadata instead. When a response fails the check, the system removes it, warns, or escalates, depending on the failure. Applied this way, the attack's success rate drops to 2.3%, and benign task accuracy ticks up slightly rather than falling, per the paper.
The fix does not touch the model. It targets the pipe between tool and agent, the part most agent frameworks still trust by default because checking it adds a step.
The paper doesn't say what the validation costs in latency, or which tool-calling frameworks it tested. Anyone wiring this into a production agent handling real tool calls needs that answer first.
Each link below shares sources, entities, or timing with this story.
Same source / Shared topic
Cite the same source (arXiv); overlapping topics (against, attack, benign, contract, provenance).
Shared entity: Static / Same source domain / Shared topic / Earlier coverage
Both cover Static; reported by the same outlet (arxiv.org); overlapping topics (against, attack).
Same source / Shared topic
Cite the same source (arXiv); overlapping topics (attack, benign, provenance).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (against, attack, benign); pushes against this story (against).
Shared entity: Static / Same source domain / Earlier coverage
Both cover Static; reported by the same outlet (arxiv.org); earlier Static coverage from 2026-08-12.
Both cover Static; reported by the same outlet (arxiv.org); earlier Static coverage from 2026-06-26.
Shared entity: Static / Shared topic / Earlier coverage
Both cover Static; overlapping topics (against, have); earlier Static coverage from 2026-06-23.
Shared entity: Static / Same source domain / Earlier coverage
Both cover Static; reported by the same outlet (arxiv.org); earlier Static coverage from 2026-06-02.