---
title: "Comment by Kartik N V J K on \"Prompt Injection: Why AI Agents Shouldn't Trust Their Own Tools\" | Hashnode"
description: "Framing injection as structural, one flat token stream with no boundary between instruction and data, is the part people keep missing while they chase prompt-le"
url: "https://hashnode.com/posts/prompt-injection-why-ai-agents-shouldn-t-trust-their-own-tools/6ac8900f47ebf6b7c629c6ca/comment/6ac93d032528f23f10d8494b"
---

[Discussion](https://hashnode.com/posts/prompt-injection-why-ai-agents-shouldn-t-trust-their-own-tools/6ac8900f47ebf6b7c629c6ca)

Comment [Prompt Injection: Why AI Agents Shouldn't Trust Their Own Tools](https://hashnode.com/posts/prompt-injection-why-ai-agents-shouldn-t-trust-their-own-tools/6ac8900f47ebf6b7c629c6ca)

[Kartik N V J K](https://hashnode.com/@kartik-nvj)

[Oct 9](https://hashnode.com/posts/prompt-injection-why-ai-agents-shouldn-t-trust-their-own-tools/6ac8900f47ebf6b7c629c6ca/comment/6ac93d032528f23f10d8494b)

Framing injection as structural, one flat token stream with no boundary between instruction and data, is the part people keep missing while they chase prompt-level patches. The MCPTox 60%+ number lines up with what shows up once the tool descriptions themselves carry the payload. Do you treat tool descriptions as untrusted input in your own agents yet?

[Nagappan S](https://hashnode.com/@imkarthik03)

[Oct 13](https://hashnode.com/posts/prompt-injection-why-ai-agents-shouldn-t-trust-their-own-tools/6ac8900f47ebf6b7c629c6ca/comment/6ac93d032528f23f10d8494b#reply-6acdd359761f328b046ee303)

Yes. Tool descriptions get the same treatment as tool output: untrusted until proven otherwise. In practice that means pinning descriptions at approval time and diffing them on every load, so a server can't change its description after you've trusted it. I also show the full description to the user rather than a summary, and keep tools from different servers from sharing a context with high-privilege credentials. The MCPTox numbers are the reason: if the payload sits in the description, the agent has read it before any output filter runs.