cot-injection

First observe the agent's normal reasoning loop and record the exact format of tool return results such as Observation blocks. Then embed a forged result in user input matching that format and check whether the model skips the real tool call and acts on the fabricated data.

Traditional SQL injection directly manipulates parameter concatenation in a query interface. CoT query injection works indirectly through natural language, causing the LLM to autonomously generate malicious SQL or API queries during its reasoning process, sometimes via poisoned RAG documents.

Check whether responses expose intermediate steps like Thought, Action, or Observation markers, and identify which external tools the agent calls during reasoning. Longer reasoning chains with more conditional branches present a larger injectable attack surface.

Independently validate tool return results instead of trusting model judgment, hardcode critical verification steps outside the LLM reasoning chain, sanitize user input resembling internal agent protocols, and use parameterized queries with separate approval flows for sensitive operations.

It does not apply when the application uses single-turn prompting without multi-step reasoning or tool calls, since there is no reasoning chain to interfere with. In those cases, direct prompt injection or jailbreak testing is the appropriate approach.