New to ShortSpan? We distil the AI-security research that matters into practitioner takeaways — edited by Ben Williams (NCC Group).Get the weekly email
// Analysis
ToolSiphon Drains LLM Agent Tools to Rebuild Data
Published: Tue, 01 Sep 2026 • By Rowan Vale
Agents
Researchers show a query-only attack can reconstruct most of a knowledge source behind Large Language Model (LLM) agents. ToolSiphon steers calls to a target tool and chains facts from answers to expand coverage, recovering up to 74.3% of records and working across RAG, database and search-backed tools, even against common filters.
Hook an agent to a tool and you create a new data leak. This paper is a clean, testable blueprint for how to drain the knowledge behind Large Language Model (LLM) agents using nothing but normal user queries. No privileged access, no jailbreaks needed. Just steer the agent and hoover up what it legitimately reveals.
How the attack lands
Two agent behaviours make extraction tricky. First, tool-selection uncertainty: the agent may pick the wrong tool. Second, tool-argument compression: when the agent builds a query for the tool, it drops useful detail. ToolSiphon tackles both.
Step one is Tool Contrastive Analysis. In plain terms: find wording that makes the agent reliably call your target tool instead of its neighbours. The attacker probes with variant prompts, watches which tool fires, and keeps the functional phrases that tilt routing toward the target. Once you mostly hit the right tool, the firehose opens.
Step two is Evidence-Chained Feedback. Each answer is mined for compact facts the agent cannot help but reveal: entities, identifiers, attributes. Those snippets are fed back into the next query to counter the agent’s tendency to compress tool arguments. Over many rounds, this grows coverage from scattered facts into full records. It is query-only, using only final responses; no tool-internal outputs are required.
Why it matters
Across three tool types and six domains, the attack reconstructs a lot. With only coarse descriptions of other tools, it recovers on average 74.3% of source records, with 83.2% textual recovery and 90.2% semantic similarity. Without any descriptions, it still hits 66.3% coverage with 76.7% textual recovery and 85.5% similarity. By an aggregate score, it outperforms the best adapted baseline by roughly 2.2×.
It is also stubborn. Input filters, intent detectors, output filters and a system-prompt defence all reduce but do not stop leakage. The method works against real agent platforms and drives very high target-tool invocation rates in controlled tests.
Limits exist. If two tools are functionally indistinguishable, steering falters and attribution craters. Strict back-end access tiers cap what can be recovered. Large sources and tight tool interfaces slow everything down under a fixed query budget.
Net result: if your agent can see it, a patient attacker can likely reconstruct it. The interesting open problem is not whether this class of leakage exists, but how to measure and bound it when tool routing and argument generation are the leakiest parts of the pipeline.
Additional analysis of the original ArXiv paper
📋Original Paper Title and Abstract
Extracting Knowledge from Tools in LLM Agents
Authors: Chuanchao Zang, Jianing Wang, Wenyu Chen, Xiangtao Meng, Li Wang, Xinyu Gao, Yingkai Dong, Zheng Li, and Shanqing Guo
LLM agents commonly use knowledge-based tools and access their underlying files, databases, and search indexes through tool invocation. This integration improves agents' ability to provide domain-specific services but also introduces the risk of tool-mediated knowledge extraction: source content exposed to an agent for legitimate responses may be progressively recovered from its outputs, enabling reconstruction of the knowledge source behind a target tool. This paper systematically investigates this risk and identifies two challenges introduced by tool invocation: tool-selection uncertainty, where an agent may invoke a competing tool instead of the target tool, and tool-argument compression, where fine-grained query information may be lost when the agent generates tool arguments. To tackle these challenges, we propose ToolSiphon, a query-only extraction attack that introduces two complementary signals: a target-discriminative signal, implemented through Tool Contrastive Analysis, to steer queries toward the target tool; and a response-grounded factual signal, implemented through Evidence Chained Feedback, to mitigate argument compression and progressively expand extraction coverage. Across three types of knowledge-based tools and six domain-specific datasets, ToolSiphon recovers 74.3% of source records on average when coarse-grained information about non-target tools is available, with 83.2% textual recovery and 90.2% semantic similarity. Even without such information, it recovers 66.3% of source records. ToolSiphon also remains effective against representative defenses and on three real-world agent platforms.
🔍ShortSpan Analysis of the Paper
Problem
The paper studies the risk that an adversary can reconstruct the contents of knowledge sources that LLM agents access via knowledge-based tools. Although tools improve domain capability by letting agents query documents, databases or indexes, the agent's public responses can gradually leak source records. This “tool-mediated knowledge extraction” differs from direct retrieval or memory extraction because user queries are routed through the agent’s tool selection and argument-generation steps, which introduce distinct challenges and a novel attack surface for exfiltration of proprietary or sensitive content.
Approach
The authors propose ToolSiphon, a query-only extraction attack that iteratively interacts with an agent’s public interface and observes only final responses. ToolSiphon addresses two agent-specific challenges: tool-selection uncertainty (queries may be routed to competing tools) and tool-argument compression (fine details are lost when the agent formulates tool arguments). The method combines two signals: Tool Contrastive Analysis (TCA) extracts target-specific functional phrases to steer queries toward the target tool, and Evidence-Chained Feedback (ECF) accumulates compact evidence items from prior answers (entities, identifiers, attributes) to guide further exploration. Evaluations use three tool types (RAG, database-backed, search-engine) and six domain datasets, fixed query budgets, and metrics for coverage and fidelity (Extraction Coverage, Chunk Recovery Ratio, Semantic Similarity and an aggregate KSR score). The threat model assumes only public-facing knowledge of the target tool and two attacker settings: A1 (coarse descriptions of other tools available) and A2 (no descriptions; shadow tools generated locally).
Key Findings
High reconstruction rates: with coarse descriptions of non-target tools (A1), ToolSiphon recovers 74.3% of source records on average, with 83.2% textual recovery and 90.2% semantic similarity; without those descriptions (A2) recovery is 66.3% with 76.7% textual recovery and 85.5% semantic similarity.
Strong overall reconstruction quality: average KSR is 76.0% under A1 and 69.5% under A2. By tool type under A1, KSR scores were 83.5% (RAG), 64.0% (database), and 80.5% (search); under A2 they were 77.0%, 59.5%, and 72.0% respectively.
Substantial advantage over baselines: the best adapted baseline (Jail-IKEA) achieved KSRs of 34.0% (A1) and 30.5% (A2); ToolSiphon improved KSR by roughly 2.2×. Ablations show TCA and ECF are complementary: removing both yields EC 16.7% and KSR 9.7%; both together produce EC ~68.7%, CRR ~80.0%, SS ~92.0% and KSR ~71.8%.
Resilience and practical reach: ToolSiphon remains effective against input filters, intent detectors, output-level filters and a system-prompt defence (which reduces but does not eliminate leakage), and works on real-world agent platforms (GPTs, Coze, Dify). It also observes very high target-invocation rates (~97–98%) in controlled tests.
Scope and limiting factors: strict, fine-grained back-end access controls stop recovery beyond authorised tiers; functionally identical competing tools greatly reduce ability to attribute records to a given source and sharply lower KSR.
Limitations
The attack assumes target and competing tools are distinguishable in functionality; performance degrades if tools are functionally identical or if tool descriptions are severely noisy. The study does not attempt to bypass access controls and focuses on extracting knowledge within the attacker’s authorised scope. Large knowledge-source scale and highly constrained tool interfaces reduce coverage under a fixed query budget.
Implications
An attacker can systematically exfiltrate large portions of a tool-backed knowledge source solely via ordinary agent interactions, using only public interfaces and modest prior knowledge. This permits reconstruction of clinical guidelines, proprietary reports or curated datasets and could enable IP theft, replication of domain-specific services or data re‑use within the attacker’s permissioned scope. The attack is iterative and hard to detect from single queries, works across tool types and platforms, and remains effective against several common defences, increasing the practical risk of tool-mediated data leakage.
- It shows a real risk: long-term memory in LLM agents can be exfiltrated via the tool interface, even when memory is “isolated,” because private data...
- It shows a stealthy backdoor in tool-using LLMs that can secretly read memory and leak data via disguised tool calls, with leakage amplified across ...
- It spotlights a new risk: poisoned or fake tool outputs can mislead AI agents that rely on external tools, shifting from capability to deception con...
- Why relevant: It reveals a vulnerability in how LLM-powered agents choose external tools. By tweaking tool names/descriptions, an attacker can bias ...
In simple terms, it shows a prompt-injection attack that corrupts an LLM agent’s tool library so the agent consistently uses the attacker’s malicious ...
- It reveals a stealthy, multi-turn DoS that targets the tool-call loop of LLM agents, not just final outputs, exposing a new attack surface beyond tr...
- The paper shows a real-world style attack where poisoning a knowledge graph that AI agents query during reasoning can make the agents arrive at fals...
- It reveals a practical long-horizon poisoning risk: attackers can steer an AI agent’s evidence-gathering across multiple search results, not just a ...
- It exposes a new threat: poisoned experiences can be turned by the agent into durable, reusable skills, not just affect a single run.
- The attack h...
- It tackles indirect prompt injection that unfolds over multiple turns by treating it as a temporal takeover, not a one-shot bug, and aims to detect ...
Get the weekly digest
The few AI-security papers that matter, with the practitioner takeaway. No spam.
