Techniques
Sample rules
AWS Bedrock Unusual Tool Selection
- source: elastic
- technicques:
Description
A machine learning job has detected that an Amazon Bedrock model requested a tool that is rare for a caller, compared with that caller’s own history. A model that suddenly selects an unfamiliar tool can indicate that an AI agent was redirected toward an unexpected capability, for example through prompt injection or unsafe delegation (OWASP ASI02, Tool Misuse and Exploitation). The tool name is a requested operation in the model output, not a confirmed tool execution.
Detection logic