Indirect Prompt Injection Through Tool Descriptions and Tool Output: How Untrusted Metadata Hijacks Agents

How tool metadata and returned content can hijack a function-calling agent, and the defensive patterns that contain it: untrusted output, allowlists,