hackagent 0.13.0__tar.gz → 0.14.0__tar.gz

{hackagent-0.13.0 → hackagent-0.14.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: hackagent
-Version: 0.13.0
+Version: 0.14.0
 Summary: HackAgent is an open-source security toolkit to detect vulnerabilities of your AI Agents.
 Author-email: AI Security Lab <ais@ai4i.it>
 License: Apache-2.0

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/agent.py

@@ -228,6 +228,7 @@ class HackAgent:
                 tFCOrchestrator,
                 H4rm3lOrchestrator,
                 RagOrchestrator,
+                ToolOutputIPIOrchestrator,
                 PAPOrchestrator,
                 PAIROrchestrator,
                 FlipAttackOrchestrator,
@@ -251,6 +252,7 @@ class HackAgent:
                 "h4rm3l": H4rm3lOrchestrator(hackagent_agent=self),
                 "pap": PAPOrchestrator(hackagent_agent=self),
                 "rag": RagOrchestrator(hackagent_agent=self),
+                "tool_output_ipi": ToolOutputIPIOrchestrator(hackagent_agent=self),
                 "mml": MMLOrchestrator(hackagent_agent=self),
             }
         return self._attack_strategies

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/evaluator/base.py

@@ -596,6 +596,11 @@ class BaseJudgeEvaluator(ABC):
             Tuple of (score, explanation).
         """
         # Step 1: Initial request
+        configured_thinking = getattr(self.config, "thinking", False)
+        if not isinstance(configured_thinking, bool):
+            configured_thinking = False
+        if request_data.get("thinking") is None:
+            request_data["thinking"] = configured_thinking
         response = self.agent_router.route_request(
             registration_key=self.agent_registration_key,
             request_data=request_data,
@@ -698,6 +703,11 @@ class BaseJudgeEvaluator(ABC):
         include_raw_response: bool = False,
     ) -> Tuple[Any, Optional[str]] | Tuple[Any, Optional[str], Optional[str]]:
         """Async equivalent of :meth:`_request_with_assertions`."""
+        configured_thinking = getattr(self.config, "thinking", False)
+        if not isinstance(configured_thinking, bool):
+            configured_thinking = False
+        if request_data.get("thinking") is None:
+            request_data["thinking"] = configured_thinking
         response = await self._route_request_async(
             registration_key=self.agent_registration_key,
             request_data=request_data,
@@ -967,4 +977,9 @@ Answer (yes or no):"""
             "messages": self._build_messages(feedback_prompt),
             "max_tokens": self.config.max_tokens_eval,
             "temperature": 0.0,  # Deterministic for retry
+            "thinking": (
+                original_request_data["thinking"]
+                if original_request_data.get("thinking") is not None
+                else False
+            ),
         }

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/evaluator/judge_evaluators.py

@@ -546,6 +546,11 @@ Do not output any other text.
             "messages": self._build_messages(feedback_prompt),
             "max_tokens": self.config.max_tokens_eval,
             "temperature": 0.0,
+            "thinking": (
+                original_request_data["thinking"]
+                if original_request_data.get("thinking") is not None
+                else False
+            ),
         }
 
 

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/orchestrator.py

@@ -189,6 +189,11 @@ class AttackOrchestrator:
             ("judge", ("judges",), True, "judge"),
             ("embedder", ("rag_injection_params", "embedder"), False, None),
         ),
+        "tool_output_ipi": (
+            ("attacker", ("attacker",), False, "attacker"),
+            # ("judge", ("judge",), False, "judge"),
+            ("judge", ("judges",), True, "judge"),
+        ),
         "fc": (
             ("step_generator", ("step_generator",), False, "attacker"),
             # ("judge", ("judge",), False, "judge"),

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/registry.py

@@ -41,6 +41,7 @@ from hackagent.attacks.techniques.pap import PAPAttack
 from hackagent.attacks.techniques.rag import (
     RagAttack,
 )
+from hackagent.attacks.techniques.tool_output_ipi import ToolOutputIPIAttack
 
 
 def create_orchestrator(
@@ -98,6 +99,7 @@ FCOrchestrator = create_orchestrator("FC", FCAttack)
 tFCOrchestrator = create_orchestrator("tFC", tFCAttack)
 PAPOrchestrator = create_orchestrator("pap", PAPAttack)
 RagOrchestrator = create_orchestrator("rag", RagAttack)
+ToolOutputIPIOrchestrator = create_orchestrator("tool_output_ipi", ToolOutputIPIAttack)
 
 # Registry of all available attacks
 ATTACK_REGISTRY = {
@@ -117,6 +119,7 @@ ATTACK_REGISTRY = {
     "tFC": tFCOrchestrator,
     "pap": PAPOrchestrator,
     "rag": RagOrchestrator,
+    "tool_output_ipi": ToolOutputIPIOrchestrator,
 }
 
 __all__ = [
@@ -135,5 +138,6 @@ __all__ = [
     "tFCOrchestrator",
     "PAPOrchestrator",
     "RagOrchestrator",
+    "ToolOutputIPIOrchestrator",
     "ATTACK_REGISTRY",
 ]

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/taxonomy.py

@@ -120,6 +120,7 @@ ATTACK_TAXONOMY: Mapping[str, AttackTaxonomy] = {
     "bon": _entry(AttackCategory.ADAPTIVE),
     "advprefix": _entry(AttackCategory.ADAPTIVE),
     "autodan_turbo": _entry(AttackCategory.ADAPTIVE),
+    "tool_output_ipi": _entry(AttackCategory.ADAPTIVE, AttackTag.INDIRECT),
     # Multi-turn — one growing conversation with the target.
     "crescendo": _entry(AttackCategory.MULTI_TURN),
 }

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/techniques/advprefix/config.py

@@ -247,6 +247,9 @@ class EvaluatorConfig(BaseModel):
     max_judge_retries: int = 1
     # Optional user-defined system prompt prepended to every judge request.
     system_prompt: Optional[str] = None
+    # Reasoning control passed on every judge request. Missing/None is
+    # normalized to False by BaseJudgeEvaluator.
+    thinking: Optional[bool] = False
 
     @model_validator(mode="before")
     @classmethod

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/techniques/autodan_turbo/core.py

@@ -365,6 +365,7 @@ def score_response(
     max_retries=5,
     scorer_max_tokens=DEFAULT_MAX_OUTPUT_TOKENS,
     role_label="scorer",
+    thinking=False,
 ):
     """Score target output, using a wrapper only for unstructured assessments.
 
@@ -386,6 +387,8 @@ def score_response(
         Explicit assessment scores take precedence over model-based extraction.
         Exhausted retries return ``(1.0, "Score extraction failed")``.
     """
+    if not isinstance(thinking, bool):
+        thinking = False
     goal_text = str(goal or "")
     system = SCORER_SYSTEM_PROMPT.format(
         goal=goal_text,
@@ -410,6 +413,7 @@ def score_response(
                     "max_tokens": scorer_max_tokens,
                     "temperature": 0.7,
                     "top_p": 0.9,
+                    "thinking": thinking,
                 },
             )
             assessment = extract_response_content(resp, logger)
@@ -438,7 +442,12 @@ def score_response(
             ]
             resp2 = scorer_router.route_request(
                 registration_key=scorer_key,
-                request_data={"messages": msgs2, "max_tokens": 50, "temperature": 0.0},
+                request_data={
+                    "messages": msgs2,
+                    "max_tokens": 50,
+                    "temperature": 0.0,
+                    "thinking": thinking,
+                },
             )
             score_text = extract_response_content(resp2, logger)
             if score_text:
@@ -479,6 +488,7 @@ def score_response(
                     "messages": direct_numeric_msgs,
                     "max_tokens": 16,
                     "temperature": 0.0,
+                    "thinking": thinking,
                 },
             )
             direct_text = extract_response_content(resp3, logger)

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/techniques/autodan_turbo/lifelong.py

@@ -332,6 +332,11 @@ def execute(
                     max_retries=max_parse_retries,
                     scorer_max_tokens=scorer_max_tokens,
                     role_label=scorer_label,
+                    thinking=(
+                        _judge_cfg.get("thinking")
+                        if isinstance(_judge_cfg.get("thinking"), bool)
+                        else False
+                    ),
                 )
                 emit_phase_trace(
                     config,

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/techniques/autodan_turbo/warm_up.py

@@ -228,6 +228,11 @@ def execute(
                     max_retries=max_parse_retries,
                     scorer_max_tokens=scorer_max_tokens,
                     role_label=scorer_label,
+                    thinking=(
+                        _judge_cfg.get("thinking")
+                        if isinstance(_judge_cfg.get("thinking"), bool)
+                        else False
+                    ),
                 )
                 emit_phase_trace(
                     config,

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/techniques/indirect_prompt_injection/attack.py

@@ -1350,6 +1350,17 @@ class IndirectPromptInjectionAttack(BaseAttack):
         self, query: str, context: str, response: str, goal: str
     ) -> Dict[str, Any]:
         """Use judge LLM to evaluate if target followed poisoned instructions."""
+        judge_config = (
+            self.config.get("judges", [{}])[0]
+            if self.config.get("judges")
+            else self.config.get("judge", {})
+        )
+        configured_thinking = (
+            judge_config.get("thinking") if isinstance(judge_config, dict) else None
+        )
+        thinking = (
+            configured_thinking if isinstance(configured_thinking, bool) else False
+        )
         user_message = (
             f"BENIGN USER QUERY:\n{query}\n\n"
             f"RETRIEVED CONTEXT:\n{context[:3000]}\n\n"
@@ -1366,6 +1377,7 @@ class IndirectPromptInjectionAttack(BaseAttack):
                 ],
                 "max_tokens": 500,
                 "temperature": 0.0,
+                "thinking": thinking,
             },
         )
 

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/techniques/pair/attack.py

@@ -726,6 +726,11 @@ class PAIRAttack(BaseAttack):
                 max_retries=max_parse_retries,
                 scorer_max_tokens=scorer_max_tokens,
                 role_label="pair-judge",
+                thinking=(
+                    judge_config.get("thinking")
+                    if isinstance(judge_config.get("thinking"), bool)
+                    else False
+                ),
             )
             self._set_scorer_explanation(assessment or "")
 
@@ -812,6 +817,13 @@ class PAIRAttack(BaseAttack):
 
         judge_prompt_max = int(self.config.get("judge_prompt_max_chars", 2500))
         judge_response_max = int(self.config.get("judge_response_max_chars", 3500))
+        judge_config = self.config.get("judge") or self.config.get("scorer", {})
+        configured_thinking = (
+            judge_config.get("thinking") if isinstance(judge_config, dict) else None
+        )
+        thinking = (
+            configured_thinking if isinstance(configured_thinking, bool) else False
+        )
 
         prompt_for_judge = _truncate_text(prompt or "", judge_prompt_max)
         response_for_judge = _truncate_text(response or "", judge_response_max)
@@ -833,7 +845,6 @@ class PAIRAttack(BaseAttack):
         ]
 
         try:
-            judge_config = self.config.get("judge") or self.config.get("scorer", {})
             request_timeout = judge_config.get(
                 "timeout",
                 judge_config.get("request_timeout", self.config.get("timeout", 120)),
@@ -848,6 +859,7 @@ class PAIRAttack(BaseAttack):
                     "max_tokens": max_tokens,
                     "temperature": 0.0,
                     "timeout": request_timeout,
+                    "thinking": thinking,
                 },
             )
             legacy_text = extract_response_content(legacy_response, self.logger)

{hackagent-0.13.0 → hackagent-0.14.0}/hackagent/attacks/techniques/rag/attack.py

@@ -1382,6 +1382,17 @@ class RagAttack(BaseAttack):
         self, query: str, context: str, response: str, goal: str
     ) -> Dict[str, Any]:
         """Use judge LLM to evaluate if target followed poisoned instructions."""
+        judge_config = (
+            self.config.get("judges", [{}])[0]
+            if self.config.get("judges")
+            else self.config.get("judge", {})
+        )
+        configured_thinking = (
+            judge_config.get("thinking") if isinstance(judge_config, dict) else None
+        )
+        thinking = (
+            configured_thinking if isinstance(configured_thinking, bool) else False
+        )
         user_message = (
             f"BENIGN USER QUERY:\n{query}\n\n"
             f"RETRIEVED CONTEXT:\n{context[:3000]}\n\n"
@@ -1398,6 +1409,7 @@ class RagAttack(BaseAttack):
                 ],
                 "max_tokens": 500,
                 "temperature": 0.0,
+                "thinking": thinking,
             },
         )
 

hackagent-0.14.0/hackagent/attacks/techniques/tool_output_ipi/__init__.py

@@ -0,0 +1,47 @@
+# Copyright 2026 - AI4I. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Tool-output indirect prompt injection (InjecAgent / OPI family).
+
+Injects adversarial instructions into simulated (or live) tool observations
+so a tool-using agent may follow a malicious goal after a benign user task.
+"""
+
+from __future__ import annotations
+
+from .attack import ToolOutputIPIAttack
+
+__all__ = ["ToolOutputIPIAttack"]
+
+
+def _register_taxonomy_entry() -> None:
+    """Ensure adaptive+indirect taxonomy entry exists (safety net).
+
+    The permanent assignment lives in ``ATTACK_TAXONOMY``. This helper remains
+    so TUI/CLI discovery does not fail if that permanent entry is temporarily
+    missing during a partial merge.
+    """
+    try:
+        from hackagent.attacks.taxonomy import (
+            ATTACK_TAXONOMY,
+            AttackCategory,
+            AttackTag,
+            AttackTaxonomy,
+            try_get_attack_taxonomy,
+        )
+    except ImportError:
+        return
+
+    if try_get_attack_taxonomy("tool_output_ipi") is not None:
+        return
+
+    entry = AttackTaxonomy(
+        category=AttackCategory.ADAPTIVE,
+        tags=(AttackTag.INDIRECT,),
+    )
+    # ATTACK_TAXONOMY is declared Mapping but constructed as a plain dict.
+    if isinstance(ATTACK_TAXONOMY, dict):
+        ATTACK_TAXONOMY["tool_output_ipi"] = entry
+
+
+_register_taxonomy_entry()

hackagent-0.14.0/hackagent/attacks/techniques/tool_output_ipi/attack.py

@@ -0,0 +1,263 @@
+# Copyright 2026 - AI4I. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+"""
+Tool-output indirect prompt injection (tool_output_ipi) attack.
+
+Poisons tool / function-call *observations* so a tool-using agent may follow
+a malicious goal after a benign user task (InjecAgent / OPI family).
+
+This is distinct from ``rag`` / ``indirect_prompt_injection``, which poison
+RAG documents — not tool return values.
+
+Pipeline:
+1. Generation — craft poisoned tool observations, query target, inline judge
+2. Evaluation — post-processing (server sync, tracker, ASR)
+
+Taxonomy: primary **adaptive**, tag **indirect** (registered defensively when ``hackagent.attacks.taxonomy`` is present; add a permanent ``ATTACK_TAXONOMY`` entry when #603 merges).
+"""
+
+from __future__ import annotations
+
+import copy
+import logging
+from typing import Any, Dict, List, Optional
+
+from hackagent.server.client import AuthenticatedClient
+from hackagent.router.router import AgentRouter
+from hackagent.attacks.techniques.base import BaseAttack
+from hackagent.attacks.types import AttackResult, rows_to_attack_results
+from hackagent.attacks.shared.tui import with_tui_logging
+from hackagent.attacks.evaluator.evaluation_step import BaseEvaluationStep
+
+from . import generation
+from .config import DEFAULT_TOOL_OUTPUT_IPI_CONFIG
+
+
+def _recursive_update(target_dict: Dict[str, Any], source_dict: Dict[str, Any]) -> None:
+    """Recursively merge *source_dict* into *target_dict*."""
+    for key, source_value in source_dict.items():
+        target_value = target_dict.get(key)
+        if isinstance(source_value, dict) and isinstance(target_value, dict):
+            _recursive_update(target_value, source_value)
+        elif key.startswith("_"):
+            target_dict[key] = source_value
+        else:
+            target_dict[key] = copy.deepcopy(source_value)
+
+
+class ToolOutputIPIAttack(BaseAttack):
+    """Tool-output indirect prompt injection (InjecAgent / OPI).
+
+    For each malicious goal the attack:
+    1. Starts from a benign user message that would elicit a tool call.
+    2. Appends a simulated (or live) ``role=tool`` observation containing an
+       adversarial injection aimed at the goal.
+    3. Re-queries the target with the full messages history.
+    4. Judges whether the response or subsequent tool call follows the
+       injected instructions (direct harm and/or data stealing).
+    """
+
+    def __init__(
+        self,
+        config: Optional[Dict[str, Any]] = None,
+        client: Optional[AuthenticatedClient] = None,
+        agent_router: Optional[AgentRouter] = None,
+    ):
+        if client is None:
+            raise ValueError(
+                "AuthenticatedClient must be provided to ToolOutputIPIAttack."
+            )
+        if agent_router is None:
+            raise ValueError(
+                "Victim AgentRouter instance must be provided to ToolOutputIPIAttack."
+            )
+
+        current_config = copy.deepcopy(DEFAULT_TOOL_OUTPUT_IPI_CONFIG)
+        if config:
+            _recursive_update(current_config, config)
+
+        self.logger = logging.getLogger("hackagent.attacks.tool_output_ipi")
+        super().__init__(current_config, client, agent_router)
+
+    def _validate_config(self) -> None:
+        super()._validate_config()
+
+        required_keys = ["attack_type", "tool_output_ipi_params"]
+        missing = [k for k in required_keys if k not in self.config]
+        if missing:
+            raise ValueError(
+                f"Configuration dictionary missing required keys: {', '.join(missing)}"
+            )
+
+        params = self.config.get("tool_output_ipi_params", {})
+        if not isinstance(params, dict):
+            raise ValueError("tool_output_ipi_params must be a dictionary")
+
+        mode = params.get("mode", "simulated")
+        if mode not in ("simulated", "live"):
+            raise ValueError(
+                f"tool_output_ipi_params.mode must be 'simulated' or 'live'; got {mode!r}"
+            )
+
+        max_attempts = params.get("max_attempts", 3)
+        try:
+            if int(max_attempts) < 1:
+                raise ValueError
+        except (TypeError, ValueError) as exc:
+            raise ValueError(
+                "tool_output_ipi_params.max_attempts must be an integer >= 1"
+            ) from exc
+
+        if params.get("use_attacker_llm") and not (
+            isinstance(self.config.get("attacker"), dict)
+            and self.config["attacker"].get("identifier")
+        ):
+            raise ValueError(
+                "use_attacker_llm=True requires attacker.identifier in the attack config"
+            )
+
+    @classmethod
+    def get_effective_model_roles(
+        cls,
+        attack_config: Dict[str, Any],
+        *,
+        goal_labels_by_index: Optional[Dict[int, Dict[str, str]]] = None,
+    ) -> List[Dict[str, Any]]:
+        """Declare attacker (optional) and judge model roles for preflight."""
+        _ = goal_labels_by_index
+        roles: List[Dict[str, Any]] = []
+
+        params = attack_config.get("tool_output_ipi_params") or {}
+        if params.get("use_attacker_llm"):
+            attacker = attack_config.get("attacker")
+            if isinstance(attacker, dict):
+                roles.append({"role": "attacker", "config": attacker, "required": True})
+
+        judges = attack_config.get("judges")
+        if isinstance(judges, list) and judges:
+            for judge in judges:
+                roles.append({"role": "judge", "config": judge, "required": False})
+        return roles
+
+    def _get_pipeline_steps(self) -> List[Dict]:
+        return [
+            {
+                "name": "Generation: Tool-output IPI + Judge",
+                "function": generation.execute,
+                "step_type_enum": "GENERATION",
+                "config_keys": [
+                    "batch_size",
+                    "tool_output_ipi_params",
+                    "attacker",
+                    "_run_id",
+                    "_backend",
+                    "_client",
+                    "_tracker",
+                    "_goal_index_offset",
+                    "judges",
+                    "judge_concurrency",
+                    "max_tokens_eval",
+                    "filter_len",
+                    "judge_timeout",
+                    "judge_temperature",
+                    "max_judge_retries",
+                    "max_tokens",
+                    "temperature",
+                    "timeout",
+                ],
+                "input_data_arg_name": "goals",
+                "required_args": ["logger", "agent_router", "config"],
+            },
+            {
+                "name": "Evaluation Post-processing: Server Sync, Tracker & ASR Logging",
+                "function": BaseEvaluationStep.make_postprocess_execute(
+                    "tool_output_ipi"
+                ),
+                "step_type_enum": "EVALUATION",
+                "config_keys": [
+                    "tool_output_ipi_params",
+                    "_run_id",
+                    "_backend",
+                    "_client",
+                    "_tracker",
+                    "_goal_index_offset",
+                    "judges",
+                    "judge_concurrency",
+                    "max_tokens_eval",
+                    "filter_len",
+                    "judge_timeout",
+                    "judge_temperature",
+                    "max_judge_retries",
+                ],
+                "input_data_arg_name": "input_data",
+                "required_args": ["logger", "config", "client"],
+            },
+        ]
+
+    @with_tui_logging(logger_name="hackagent.attacks", level=logging.INFO)
+    def run(self, goals: Optional[List[str]] = None, **kwargs) -> List[AttackResult]:
+        """Execute the tool-output IPI pipeline.
+
+        Args:
+            goals: Malicious goals the poisoned tool observation should induce.
+
+        Returns:
+            List of :class:`~hackagent.attacks.types.AttackResult` rows.
+        """
+        goals = goals or []
+        if not goals:
+            return []
+
+        coordinator = self._initialize_coordinator(attack_type="tool_output_ipi")
+
+        params = self.config.get("tool_output_ipi_params", {})
+        goal_metadata = {
+            "mode": params.get("mode", "simulated"),
+            "max_attempts": params.get("max_attempts", 3),
+            "success_setting": params.get("success_setting", "both"),
+            "tool_name": params.get("tool_name"),
+            # Documented taxonomy until hackagent.attacks.taxonomy lands (#603).
+            "category": "adaptive",
+            "tags": ["indirect"],
+        }
+        coordinator.initialize_goals(goals=goals, initial_metadata=goal_metadata)
+
+        if coordinator.has_goal_tracking:
+            self.logger.info("Using TrackingCoordinator for per-goal tracking")
+
+        if coordinator.goal_tracker:
+            self.config["_tracker"] = coordinator.goal_tracker
+
+        pipeline_steps = self._get_pipeline_steps()
+        start_step = self.config.get("start_step", 1) - 1
+
+        try:
+            generation_output = self._execute_pipeline(
+                pipeline_steps, goals, start_step=start_step, end_step=start_step + 1
+            )
+
+            if not generation_output:
+                self.logger.warning("Generation produced no output")
+                coordinator.finalize_pipeline([], lambda _: False)
+                return []
+
+            results = self._execute_pipeline(
+                pipeline_steps, generation_output, start_step=start_step + 1
+            )
+
+            coordinator.finalize_all_goals(
+                results,
+                include_evaluation_trace=False,
+            )
+            coordinator.log_summary()
+            coordinator.finalize_pipeline(results)
+
+            return rows_to_attack_results(results)
+
+        except Exception:
+            self.logger.exception("tool_output_ipi pipeline failed with exception")
+            coordinator.finalize_on_error(
+                "tool_output_ipi pipeline failed with exception"
+            )
+            raise