Structured-output smuggling in JSON mode
Forcing JSON output does not stop injection; attacker content can populate fields that downstream code executes or trusts.
Tag: tool-abuse
Coerce dangerous tool calls in agentic systems
Rank agent findings by the blast radius of the tool, then craft content that makes the agent invoke it and hide the action.