Armo CTO Proposes Behavior Baseline-Based Anomaly Detection to Defend Against Tool Output Injection

Structural Vulnerabilities of Tool Output Injection

Ben Hirschberg (Armo CTO) points out that Tool Output Injection attacks occur through two events—'receiving results' and 'subsequent calls'—but existing defense systems often handle them individually, leading to oversights. According to OWASP guidelines, tool output should be treated as an external source, and remote dev coding agents with cloud credentials and shell tools that read code from external contributors are particularly vulnerable.

Limitations of Existing Screening and the Dual-LLM Pattern

Existing input/output screening is pattern-based, which fails to detect indirect injections or verify actions actually executed. The Dual-LLM pattern (separating a Quarantined model and a Privileged model) is effective but causes information loss because the Privileged model cannot directly read untrusted content. Additionally, while delimiter or sandwiching techniques are effective against opportunistic attacks, success rates surge to the 90% range in adaptive attacks, making call inspection that does not rely on model cooperation essential.

ARMO's Behavior Baseline-Based Anomaly Detection

ARMO builds per-agent behavior baselines at the kernel level using its Application Profile DNA (APD™) technology. It records four fields—tool calls, arguments, sequence, and sub-activities (file/process/network)—to identify actual usage patterns unknown to attackers. When an attacker attempts an unprecedented call via commands injected through tool results, it is detected by linking them into an 'Attack Timeline.' This approach covers not only injection attacks but also simple tool misuse with the same signals.

Implementation and Recommended Actions

The ARMO solution is implemented via sensors without code changes or sidecars, validating traffic in Audit mode before blocking in Enforce mode. Credential isolation prevents cloud login leakage by returning empty values when credential path read requests are made. Recommended actions include prioritizing high-risk agents by combining untrusted fields with state-changing tools, setting baselines for top agents first, and applying enforce mode once the deviation rate stabilizes.