Capability expansion
Also written rug pull
A tool or server that was reviewed and approved in one form quietly acquires new powers later — a new parameter, a new network destination, a new filesystem reach — in a version the reviewer never saw. Approval was granted to a snapshot; execution happens against whatever is installed today. It is why reputation-based trust fails for agent supply chains, and why the durable control is evaluating the call as it is about to run rather than vetting the server once.
See also tool poisoning · action layer · OWASP ASI04
Documented incident — third-party registry ai-escape.watch ↗ (not ours): "Backdoored LiteLLM release on PyPI reached agent frameworks downstream", evidence tier B — not a tool-description rug pull but the same gap one layer down, where approval attaches to a reviewed snapshot and execution happens against whatever version is installed today.
Related terms
-
Tool poisoning
Attack concepts
Hiding instructions in the metadata an agent reads to learn how to use a tool — an MCP server's tool description, its parameter documentation, its schema…
-
Action layer
Agents & architecture
The enforcement surface at the tool call, as opposed to the prompt layer, which tries to classify text before the model sees it.
-
OWASP Agentic Top 10
Frameworks & standards
OWASP's first risk taxonomy written specifically for autonomous, tool-using agents: ASI01 Agent Goal Hijack, ASI02 Tool Misuse & Exploitation, ASI03…
Attack concepts
The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.