Securing Function Calling: Preventing Tool Execution Vulnerabilities

Giving an AI agent access to API tools and terminal commands unlocks immense capability — but also creates severe security vectors. Indirect prompt injections inside fetched web pages can hijack your agent to run malicious shell scripts or exfiltrate environment keys.

1. Threat Vectors in Tool-Calling Agents

• Indirect Prompt Injection: An attacker embeds hidden instructions inside a Markdown file or web page that your agent fetches. The agent reads the text and executes unauthorized tools.
• Server-Side Request Forgery (SSRF): Agents with web fetch tools can be tricked into hitting internal metadata endpoints (e.g. `169.254.169.254`).
• Unsanitized Shell Parameter Injection: Passing raw strings from LLM output directly into `subprocess.run(shell=True)`.

2. Hardening Best Practices

1. Schema-Level Parameter Validation: Use Pydantic or Zod schemas to enforce strict types, regex matching, and value range checks on all JSON tool arguments.
2. Human-in-the-Loop Interrupts: Require explicit developer approval before executing high-risk commands (e.g. `rm`, `git push`, API payments).
3. Containerized MicroVM Isolation: Run all agent code execution inside ephemeral Docker containers or gVisor sandboxes with network egress filtering.