Unvalidated Function Arguments

Tool handlers accept free-form model output without schema, type, or semantic validation before execution.

Impact

Injection payloads travel as tool arguments into SQL, shell, or privileged APIs.

Why this severity

Impact High × Likelihood Medium = High

Impact high: arguments reach code, SQL, or APIs. Likelihood medium: demonstrated in Semantic Kernel and across 11 LLM frameworks; no catalogued in-the-wild exploitation.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.

Method: OWASP Risk Rating Methodology

Evidence

Demonstration: RCE Vulnerability in Semantic Kernel Search Plugin (MITRE ATLAS case study AML.CS0062, 2026)
Demonstration: LLMSmith: RCE Vulnerabilities in LLM-Integrated Applications (MITRE ATLAS case study AML.CS0052, 2025)

Exploited by

Agent Tool Hijacking Threat · High severity
Prompt-to-Code Execution in Agents Threat · High severity
Goal Alignment Drift Threat · High severity

Mitigated by

Deterministic Tool Schema Validation Guardrail · Fixes high risks

Remediation

Validate every argument against a JSON Schema or protobuf contract.
Reject unexpected keys and coerce enums to closed sets.
Sanitize path and URL arguments with allowlisted hosts.

How to verify

Fuzz tool endpoints with type-confused and nested payload corpora.
Ensure schema failures never reach side-effecting code.

Pattern

const args = ToolSchema.parse(raw);
if (args.path.includes('..')) throw new DenyError('path');

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM05:2025 Improper Output Handling
LLM06:2025 Excessive Agency

OWASP Top 10 for Agentic Applications 2026

ASI02:2026 Tool Misuse and Exploitation

MITRE ATLAS

AML.T0053 AI Agent Tool Invocation

NIST AI RMF 1.0

MEASURE 2.7 AI system security and resilience are evaluated and documented