🧰 Canary Agent Tool

A tool in an AI agent's toolset that no legitimate workflow ever calls.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Register a tool with an enterprise AI agent (for example an MCP tool named like an export or admin function) that no legitimate task uses. If the agent calls it, something has redirected the agent, typically an instruction injected into content it processed, and the call carries what the injected instruction asked for.

Implementation requirements

A tool definition with an attractive name and description, registered alongside the agent's real tools
The tool returns a harmless response and logs the full call: arguments, calling session and the content the agent was processing
Alert on any invocation
Safety: the tool performs no action and returns no real data
Rollback: Unregister the tool from the agent.
Upkeep: Re-check after agent configuration changes. Monthly proof-of-life call.

Cost

Negligible.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

AI/LLM

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1698 Indirect Prompt Injection	Execution	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection — Honeypot tool definitions implemented as a prompt-injection detector in the open-source prompt-shield; no standalone precision reported. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1698 Indirect Prompt Injection as an adversary behaviour.
T1700 AI-Enabled Exfiltration	Exfiltration	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection — Honeypot tool definitions implemented as a prompt-injection detector in the open-source prompt-shield; no standalone precision reported. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1700 AI-Enabled Exfiltration as an adversary behaviour. Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game (CanaryRAG) — (D071) CanaryRAG embeds canary tokens in retrieved chunks to detect knowledge-base extraction through the model. Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs — (D071) CanaryTrace embeds watermarked canary documents in a RAG corpus to detect unauthorised use.

Evidence

Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection — Munirathinam, T., 2026 preprint
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Munirathinam (arXiv 2604.18248, 2026) implements honeypot tool definitions as a prompt-injection detector in the open-source prompt-shield; no standalone precision is reported. The attacks it targets are ATT&CK v20 T1698 and T1700.