Tool Knowledge Hijack — Identity Injection with Tool Call Arguments - ATR-2026-00715 (12afc7b6-57be-57db-bc9e-31609bcef259)
Detects the tool-knowledge-hijack attack where adversarial content addressed to the agent includes a false identity claim (from a named user) and provides exact tool call arguments for a privileged action (send_money, delete_files, escalate_privileges). The pattern combines impersonation with exact tool argument injection to bypass agent trust boundaries. Source: indirect-pi-tool-knowledge-hijack (AgentDojo corpus).