ETUDE attack exploits tool updates in LLM agents bypassing defenses
Original title: Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security
ETUDE achieves 97.6% ASR on seven agentic frameworks including Gemini CLI and Claude Code by embedding malicious functionality in tool updates.
LLM agents rely on external tools that can be updated without re-verification. The tool update gap creates supply-chain vulnerabilities as updated code executes outside the LLM context. ETUDE embeds malicious functionality in benign tools to produce compromised versions. Existing defenses provide insufficient protection.
- ETUDE bypasses defenses restricted to model-visible content
- 97.6% ASR while maintaining 95.9% legitimate task completion
- Evaluated on three attack workloads and seven frameworks
- Trust established for a tool does not remain valid after updates
Impact: malicious functionality in tool updates bypassing LLM defenses
From the original article
1 min read at arxiv.orgLarge language model based agents increasingly rely on external tools to invoke services and interact with web resources. These tools can evolve through software updates, yet agentic frameworks may continue trusting them without re-verifying their safety after implementation changes.
By Shiyu Kan · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.