Analysis · curated 11 Sep 2026
The Missing Control: A Design Proposal for Tool-Output Redaction in AI Agents | Amine Raji, PhD
First reported aminrj.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Tool-output redaction addresses a gap defenders often overlook: even with prompt-injection and identity controls in place, raw sensitive data returned by agent tools remains exfiltratable through the lethal-trifecta pattern.
Amine Raji's design proposal argues that the tool-call boundary—where a tool returns raw data (customer names, emails, balances) into an agent's context—is the densest and least-controlled data-exposure point, bypassing prompt-injection defenses, identity verification, read-scope enumeration, and confused-deputy audits. The piece surveys existing approaches (Simon Willison's lethal trifecta, OWASP Top 10 for Agentic Applications, CaMeL, Prismor's PreToolUse/PostToolUse redaction hooks) and proposes tool-output redaction so the model sees only enough structure to reason, not raw sensitive values.