Yes—an AI agent can be influenced by instructions embedded in tool output. A tool result is data, not authority, but once an application places that result in the model’s context, the model may treat its contents as instructions. That creates an indirect prompt-injection risk, especially when the agent has broad permissions or can act without meaningful approval.
What “tool output is a second prompt” means
The phrase is a useful metaphor, not a formal OWASP or MCP term. It describes a trust-boundary problem: an agent retrieves or receives content, the application includes that content in the model’s context, and the model may respond to instructions found there. OWASP calls attacks that use external material such as websites or files indirect prompt injection.
As an Amazon Associate I earn from qualifying purchases.
The content does not need to come from a person typing directly into the chat. A web page, document, or other tool result can contain hostile or accidental instructions. If the application fails to keep data separate from instructions, that text can influence what the agent does next. This is a risk in system design, not a claim that every tool result causes an attack or that every model will follow embedded instructions.
How the risk becomes an action
- A tool returns content. It may be retrieved from an external website or file, or supplied by another connected system.
- The application adds it to the model’s context. The model can then process the returned text alongside the actual task instructions.
- The text influences the model’s next step. The model may treat an instruction inside the returned material as relevant, rather than as untrusted content to analyze.
- Permissions determine the possible impact. If the agent can access sensitive information or take consequential actions without adequate controls, an influenced response may lead to disclosure, misleading output, or unauthorized activity.
OWASP lists possible impacts including sensitive-information disclosure, altered or biased content, unauthorized use of functions available to the model, arbitrary commands in connected systems, and manipulated decisions. It emphasizes that severity depends on business context and the model’s agency.
#1 Best Overall
Why MCP tool descriptions also matter
Tool output is not the only text an agent may rely on. Tool descriptions can also influence how a model uses connected capabilities. In an April 1, 2025 advisory, Invariant Labs described MCP tool-poisoning demonstrations in which instructions were embedded in a tool description that the model could see but users might not.
Tool poisoning, shadowing, and changing descriptions
Invariant’s advisory describes an apparently ordinary add tool with a model-visible description instructing the model to read configuration and SSH-key files and conceal that behavior. It also reports a “rug pull,” in which a server changes a tool description after approval, and “shadowing,” in which a malicious tool description attempts to change how an agent uses another connected tool.
These are scenarios reported by Invariant Labs, not evidence that every MCP server or client behaves this way. They illustrate why operators should consider tool metadata as part of the trust boundary, alongside the content returned when a tool runs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How to reduce the risk in an agent or MCP system
No single prompt wording or filtering trick guarantees prevention. OWASP says it is unclear whether fool-proof prompt-injection prevention is possible, so the practical goal is to reduce both the likelihood and the impact through layered controls.
Keep external content separate from instructions
Label and segregate retrieved or tool-returned material as untrusted data. OWASP’s mitigation guidance calls for segregating and identifying external content. The application should make clear to the model which material it may analyze and which instructions actually govern its behavior.
Limit what the model can do
Grant the model only the permissions required for its task. Where possible, keep API tokens and sensitive operations in application code rather than exposing them directly to the model. A malicious instruction has less opportunity to cause harm if the agent cannot reach sensitive data or perform consequential actions on its own.
Validate data and constrain actions
Define expected input and output formats, then validate them deterministically before acting on them. Input and output filtering can help as supporting controls, but should not be treated as a complete defense. For actions that expose sensitive data or create external side effects, require human approval at the point of action.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Make MCP tools visible and verifiable
For MCP deployments, Invariant Labs recommends showing users full tool descriptions and relevant arguments, pinning server and tool versions, and checking hashes or checksums. These measures help operators notice unexpected descriptions or changes; they do not establish that a tool is safe in every respect.
Test trust boundaries regularly
Run adversarial tests and breach simulations against the system’s trust boundaries and access controls. OWASP recommends testing “treating the model as an untrusted user” to assess whether those controls hold. Include tests for untrusted content and for the actions an agent can take after processing it.
Quick Recap
What to remember when designing a tool-using agent
- Tool output is information for the model to process, not an authority that can override the application’s rules.
- Indirect prompt injection can arrive through external content; MCP tool descriptions are a separate, reported input surface to inspect.
- The consequences depend on what information and actions the agent can access, as well as whether approval and validation controls are effective.
- Use layered safeguards—content separation, least privilege, deterministic validation, human approval, tool visibility, integrity checks, and adversarial testing—rather than relying on prompt wording alone.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
