Hunt Agent Tool Injection

Agents hand tools an interpreter — shell, Python, SQL, JS, or a fetch/URL client. When user input reaches that interpreter unsanitized, the agent executes attacker code inside the trust zone (often a service account with cloud creds). Characterize the primitive before firing payloads, and never trust the agent's account of what it does with your input.

Where This Lives / Attack Surface Signals

• Tool described as ping, check, run, exec, system, validate, resolve, lookup → shell.
• Replies to 2+2 with 4 → code eval.
• Queries/searches/filters a datastore → SQL/NoSQL.
• Fetches URLs, previews links, imports remote content → SSRF candidate.
• "processes/validates YAML/JSON/XML/config" → parser (hunt-agent-deserialization).
• System prompt says "pass input exactly / do not sanitize" → strong injection candidate (not proof — verify).
• Output is a fixed status (reachable/unreachable, ok/fail) → blind; injection may still work → hunt-agent-blind-exfil.

Crown Jewel Targets

DevOps/SRE and infra agents running as a service account → shell/SSRF reaches cloud metadata + IAM creds (169.254.169.254, metadata.google.internal), internal-only services, secrets managers, source. Highest impact class in the bundle.