# Injected content invokes privileged tools

Untrusted text reaching a model that can call OAuth or privileged tools without per-action confirmation

_Area: AI and LLM app security. Seen in 2 disclosed reports; latest 2023-07-06. Updated 2026-10-24._

## How it works
An agent treats everything it reads as instructions: tool responses, browsed pages, file contents. When the same agent also holds privileged tools (OAuth plugins, write APIs, device automation), untrusted text can name a tool and its arguments, and the model calls it. The agent becomes a confused deputy: it acts with the user's authority on content the user never wrote. The broken assumption is that only the user drives tool calls; in practice any text in context can.

## Where it shows up
- Agents with two or more tools where one reads untrusted content and another writes or acts (read plugin chained to write plugin).
- OAuth plugins that impersonate the user, so a model-followed instruction becomes an authenticated action.
- Tool output or page text rendered into the prompt without a trust boundary.
- No per-action confirmation before state-changing calls.
- Mobile apps combining UI/XML capture with an LLM prompt loop that returns tap or gesture instructions [E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-promptspy-ushers-in-era-android-threats-using-genai.md).
- Accessibility Service or overlay permissions paired with remote-control channels [E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-promptspy-ushers-in-era-android-threats-using-genai.md).

## How to review
Trace every path from untrusted input (web page, tool response, screen text) to a privileged tool call. The invariant: no state-changing or data-egressing tool call may be triggered by content the user did not author, unless a human confirms that specific action. Check whether read tools and write tools share one authority context; if so, the chain is the bug. Confirm confirmations are per-action, not per-session, and that the model cannot supply its own approval.

## Variants seen
- Browsed page text invoking a high-privilege OAuth plugin to read and exfiltrate email [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md).
- Injected text flipping private GitHub repos to public via an OAuth plugin [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md).
- Malware using an LLM prompt over captured UI XML to issue taps and pin itself, plus VNC for control [E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-promptspy-ushers-in-era-android-threats-using-genai.md).

## Impact and severity
Led to private data exfiltration [E1](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md), unauthorized public disclosure of private repos [E3](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md), and full device control [E2](https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-promptspy-ushers-in-era-android-threats-using-genai.md). Severity rises with the privilege of reachable tools, silent execution, and read-plus-write tool combinations that enable exfiltration.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-cross-plugin-request-forgery-and-prompt-injection-.md
- E2: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-promptspy-ushers-in-era-android-threats-using-genai.md
- E3: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-chatgpt-chat-with-code-plugin-take-down.md