A tool update attack works 97.6% of the time on AI agents

Researchers showed ETUDE, an attack that puts bad code in an update of a tool that was safe before. They examined it on 7 agent frameworks with 3 attack workloads. The attack success rate was 97.6%, and the agent completed 95.9% of its correct tasks. The authors tell that defenses in use give protection that is not sufficient.

How it works

A tool is software that an agent uses to do a task. A framework can use a tool after one check and not check it again after an update. ETUDE adds bad code in an update, and the tool keeps its correct function.

The numbers

The tests include Gemini CLI and Codex CLI. The attack uses no hidden instructions for the model, and it does not use model text. The authors tell that other defenses do not work, but the abstract gives no results for them.

What is not known

The text gives no repair and does not tell how many tools in use are open to this attack. The results come from the authors, and the text gives no test by a different group.

Insight: Attackers now aim at the code around the model

A US agency tells that a LiteLLM defect is used in attacks. In October 2026, researchers made 6 frameworks operate a tool call that a model only wrote again. ETUDE adds one more attack, on the tool update. This reads as a move of attackers from the model to the code around it, and a check on model text gives you no protection. Monitor if framework vendors check tools again after each update.