ToolSiphon reconstructs 74.3% of the knowledge base behind an agent's tool using only queries.

The attack recovers source content from a knowledge tool's responses alone, solving tool-selection uncertainty through contrastive analysis that steers queries to the target tool, and argument compression through chained evidence feedback (arXiv 2608.30288). Across three tool types and six domain datasets it recovers 74.3% of source records with 83.2% textual and 90.2% semantic similarity, dropping only to 66.3% with no information about competing tools. It stays effective against representative defenses and on three real agent platforms. Any RAG-backed tool you expose is a data-exfiltration channel by default.