Definition
An indirect prompt-injection attack in which a malicious input quietly corrupts only the arguments fed into a tool call, while the legitimate action still appears to run. Because the action itself looks normal, action-level safety checks miss it — only the parameters are wrong.
Why it matters
This attack succeeded roughly 93% of the time on real deployed agents, meaning even well-guarded agents can be steered into harmful actions without anyone noticing the anomaly.