Tool-invoking agent without input guardrail
ID |
tool-invoking-agent-without-input-guardrail |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
OWASP LLM |
LLM01:2025 — Prompt Injection |
Family |
LLM01 — Prompt Injection |
Red-team vectors |
Prompt Injection, Jailbreaks, Indirect Injection |
Tags |
ai_security |
Description
An agent that advertises tools to the model but has no input guardrail lets a hostile prompt drive those tools before any check runs. The inventory records the asymmetry — a non-empty tools[] and an empty input-guardrail coverage — but does not flag it; this detector does.
A finding is raised for each AI agent that exposes at least one tool to the model and has no guardrail covering the input side. The agent is the primary asset of the finding, and the exposed tools are listed as related assets.
Examples
from langchain.agents import initialize_agent, Tool
tools = [Tool(name="search", func=search, description="Web search")]
agent = initialize_agent(tools, llm, agent="zero-shot-react-description") # no input guardrailWrapping the agent with an input guardrail (NeMo LLMRails(config), llm_guard.scan_prompt(…) before the call, or any ai_guardrail with position=input) clears the finding.