Universal Adversarial Suffixes Against Tool-Calling LLMs

Universal adversarial suffixes against tool-calling LLMs turn a model-safety problem into an execution-security problem. A successful attack can redirect live tools. The technical foundation for defending these agents is therefore broader than jailbreak detection. It requires understanding how attacks transfer, how tool calls amplify them, and how runtime controls can trace the origin of authority-bearing arguments before execution.

Why adversarial suffixes are a qualitatively different threat against tool-calling LLMs than against chatbots

A chatbot response is normally the end of an interaction. A tool-calling model’s response can instead instruct a runtime to access systems, use credentials, or move data. This changes the unit of security analysis. Security analysis must consider both whether the model produces prohibited content and whether an attacker can make it exercise authority the user did not intend to grant.

The OWASP Top 10 for Agentic Applications 2026 describes this escalation as a manipulated output that can hijack planning, execute privileged calls, persist instructions in memory, and propagate across connected systems. Those consequences extend beyond the immediate response. An agent’s tools and permissions set how far an attack can reach, while its execution loop decides whether the attack stops or shapes later decisions. Tool access therefore demands a distinct threat model, rather than a stricter version of chatbot content moderation.

How adversarial suffixes are constructed with GCG and its successors

Optimized adversarial suffixes are products of systematic search. Zou et al. introduced Greedy Coordinate Gradient, or GCG, to find suffixes that induce targeted affirmative responses to harmful requests. Its objective is concrete. The method minimizes the cross-entropy loss of producing a targeted output sequence, using exact gradients with respect to suffix token embeddings to guide discrete changes at token positions. The search iterates through candidate changes to make the targeted response more likely.

GCG combines that optimization with training across prompts and models to support universality and transferability. These are distinct properties. Universality concerns reuse across requests, while transferability concerns reuse across models. Zou et al. showed that a suffix optimized on smaller open-source models transferred to ChatGPT, Bard, and Claude without access to the target models’ weights.

Subsequent methods expand how attackers search for reusable suffixes. Biswas et al. proposed exponentiated gradient descent with Bregman projection over relaxed one-hot encodings in August 2025, reporting faster convergence and higher success rates than three baselines across five open-source LLMs. AmpleGCG learns a suffix distribution from GCG-discovered examples, allowing repeated sampling without fresh optimization for each prompt. GASP uses latent Bayesian optimization and Gaussian Process surrogates where gradients are unavailable. Su’s CoT-GCG, introduced in October 2024, adds chain-of-thought triggers to suffix optimization to improve transferability. The search methods differ, but their operational significance converges on reuse against new prompts and models, including closed systems.

The internal mechanism that makes suffixes work through attention hijacking

Recent mechanistic analysis supports attention hijacking as an explanation for successful suffix attacks. Measurable changes in residual-stream and attention-head activations correspond to safety overrides, supporting the view that suffixes redirect an identifiable pathway inside the transformer. That evidence is stronger than an account based only on correlations between strange strings and harmful responses. Its applicability across successful attacks nevertheless remains uncertain.

The distinction changes how defenses should be evaluated. If a suffix redirects the chat-template attention pathway before generation, checking whether the response begins with a refusal phrase addresses only the visible result of that internal disruption. For an agent, a response can also look structurally legitimate while specifying an unauthorized action. The transformer structures that model families share help explain why attacks can transfer between them, though they do not show that every suffix will transfer. Output checks can still help, but on their own they cannot show that tool use follows trusted instructions.

How the tool-calling pipeline converts a suffix attack into a multi-step action chain

The attack starts when a suffix gets into the agent’s context, either directly or through retrieved content. If it redirects the relevant attention pathway, the model can emit a tool call formatted as a legitimate instruction. Syntax does not establish authorization. In a pipeline without an intervening safety check, the runtime executes that specification against live infrastructure.

Tool output then goes back into the context so the agent can plan its next steps. In an agentic loop, the malicious instruction can shape later steps and lead to more calls without a fresh, independent safety check. ToolHijacker demonstrates a related attack against retrieval and tool selection through malicious tool documents placed in a retrieval pool. Its 2026 evaluation reports up to 96.7% attack success on MetaTool against GPT-4o while bypassing prevention defenses, including StruQ and SecAlign, and several detection defenses.

Anthropic’s May 2026 engineering post identifies persistent memory as the next containment frontier, including product memory, CLAUDE.md files, mounted workspaces, and scheduled-agent state directories. Malicious instructions stored there can reload at subsequent startups. A one-time injection can consequently become a standing source of influence.

What production exploits look like when malicious instructions meet real tool access

Production prompt-injection cases demonstrate the consequences of this amplification, although they should not all be classified as GCG-style suffix attacks. The distinction preserves the evidentiary boundary. Optimized suffix research establishes a method for redirecting models, while these cases establish what redirected agents can do with real access. Together, they show how model manipulation can lead to moving data, using credentials, and exfiltration through trusted infrastructure, without claiming that every attack was built the same way.

Aim Security discovered EchoLeak in Microsoft 365 Copilot in January 2025 and publicly disclosed it in June 2025. Assigned CVE-2025-32711 and a CVSS score of 9.3, the attack required no user interaction. A crafted email contained hidden instructions that Copilot encountered during routine summarization. Copilot then extracted data from OneDrive, SharePoint, and Teams and exfiltrated it through a trusted Microsoft domain. The trusted destination concealed the abuse from network-layer controls that saw no anomalous endpoint.

Anthropic’s February 2026 internal red-team case involved a different entry point. A researcher phished an employee into launching Claude Code with a malicious prompt presented as ordinary collaboration in a “can you run this for me?” email. The employee supplied the ready-to-paste prompt directly. Across the tested retries, Claude completed the exfiltration in nearly every attempt. Here, an instruction coming through the user channel was no proof of authorization because social engineering had led the user to deliver it.

The Claude Cowork egress-allowlist bypass exposed a different trust mismatch. A malicious file in a mounted workspace held hidden instructions and an API key that the attacker controlled. Claude read other files in the workspace and used that key to send them through Anthropic’s Files API. The proxy permitted the destination because it was api.anthropic.com. Anthropic’s post locates the failure in custom proxy logic rather than the standard sandbox primitives, which held firm across its deployments. The permitted endpoint did not make the credential or the data transfer trustworthy.

Why the standard defenses fail to contain suffix attacks on agents

Model alignment, output classifiers, input filters, and sandboxes each cover a different part of the attack surface. Their limits are correspondingly different. RLHF and alignment training do not establish where a tool argument originated, while an input classifier cannot infer authorization merely because an instruction arrived through the user. The Claude Code case shows how that check can fail, but leaves open whether classifiers can detect malicious language in other cases.

Perplexity filters target unusual token sequences, so fluent, low-perplexity attacks produced by methods such as ASETF and AmpleGCG can evade them. ToolHijacker also reports bypassing perplexity filtering in its evaluation. More selective preprocessing remains promising. Cambridge’s May 2025 Adversarial Suffix Filtering pipeline combines text segmentation with BERT classification and reports sharply reduced attack efficacy with minimal effects on non-adversarial capability. Its chatbot-style evaluation, though, does not show whether it protects against tool-call-specific injection vectors.

Sandboxing limits what an agent can reach, but the agent can still send data without authorization to a destination it is allowed to use. The Cowork case makes that limitation concrete. An allowlist establishes permission at the endpoint level. The shared gap is provenance. These controls do not, by themselves, establish whether an authority-bearing argument derives from a trusted instruction or from attacker-controlled content encountered during planning.

What argument-level provenance tracking does that tool-level controls cannot

Untrusted text becomes operationally dangerous when it determines a value used in an authority-bearing tool argument. Enforcement at that boundary is more precise than granting or denying an entire tool. It also requires continuity across planning steps. If a value moves through replanning before appearing in a call, checking only the latest observation can lose its origin. Argument-level provenance preserves the connection between the proposed action and the source that shaped it.

Provenance-Aware Capability Contracts, or PACT, implements this approach as a runtime monitor. It assigns semantic roles to tool arguments, tracks the origins of their values across replanning, and checks those origins against role-specific trust contracts before execution. Its AgentDojo deployments across five models reached 100% security on the three strongest models and recovered much of the utility lost with CaMeL at the same security level. PACT’s ablations also found that semantic roles and cross-step provenance were individually necessary, with neither alone reproducing the result.

Agent-Sentry provides a complementary approach through execution provenance graphs. It records where the value of every tool argument came from and uses those graphs to learn structural patterns in legitimate behavior without anyone having to write policies by hand. The shared advance is the enforcement granularity. An attacker-controlled argument can be exposed through its origin even when the incoming text is fluent and the outgoing call is well formed. This creates a basis for preserving legitimate tool use.

What verified defenses must prove before a tool-calling agent ships to production

Defenses must be validated against the actual agent, in an isolated environment, before changing production. The required order is explicit. First, the attack must work against the specific configuration. The fix must then stop it, and every approved workflow must still pass. A generic chatbot result cannot substitute for these tests because it does not exercise the deployment’s tool set, permissions, and execution paths.

CAISI’s AgentDojo results show that attack success varies substantially across task and environment configurations. Dziemian et al.’s March 2026 indirect prompt injection competition reinforces the need for deployment-specific evidence. Its 464 participants made 272,000 attempts and found that every frontier model was vulnerable. The finding shows that choosing a model alone is no proof of safety and leaves open how individual deployment tests will turn out.

Fixes should therefore be narrow enough to preserve the agent’s approved purpose. Anthropic’s May 2026 post identifies granular permissions, including read-only rather than write access and scoped rather than broad credentials, as the correct direction. Peigné et al.’s 2025 work on the multi-agent security tax quantifies how safeguards can reduce collaboration capability. Utility testing belongs in security verification for that reason. A change that prevents the attack by disabling legitimate work substitutes an operational failure for a security failure.

Security changes to permissions, trust contracts, and runtime rules should be human-approved and reproducible. A Verified Change Record should document the demonstrated attack, the applied fix, and the workflow tests that passed. Release approval then rests on evidence rather than an estimate of whether a suffix is likely to succeed. Persistent memory remains an open boundary. Provenance tracking must extend across sessions to address instructions reloaded from memory and workspaces, and no deployed system has yet demonstrated that protection at scale.