Tool Camouflage — Forced Specific Tool Invocation via Injected Instruction - ATR-2026-00714 (e3e8a337-fd17-5bb4-b3c1-06a5ac4a9933)
Detects the tool-camouflage attack pattern where a malicious response or content masks itself as a completed task result ("Answer: task complete") while embedding an instruction that forces the agent to call a specific named tool and prohibits use of other tools. The attacker names a fake or privileged tool that the agent should invoke, bypassing normal tool selection logic. Source: indirect-pi-tool-camouflage (ASB corpus).