Enabling large language models (LLMs) to solve complex reasoning tasks is a key step toward artificial general intelligence. Recent work augments LLMs with external tools to enable agentic reasoning, achieving high utility and efficiency in a plug-and-play manner. However, the inherent vulnerabilities of such methods to malicious manipulation of the tool-calling process remain largely unexplored. In this work, we identify a tool-specific attack surface and propose Sponge Tool Attack (STA), which disrupts agentic reasoning solely by rewriting the input prompt under a strict query-only access assumption. Without any modification on the underlying model or the external tools, STA converts originally concise and efficient reasoning trajectories into unnecessarily verbose and convoluted ones before arriving at the final answer. This results in substantial computational overhead while remaining stealthy by preserving the original task semantics and user intent. To achieve this, we design STA as an iterative, multi-agent collaborative framework with explicit rewritten policy control, and generates benign-looking prompt rewrites from the original one with high semantic fidelity. Extensive experiments across 6 models (including both open-source models and closed-source APIs), 12 tools, 4 agentic frameworks, and 13 datasets spanning 5 domains validate the effectiveness of STA.

翻译：使大型语言模型（LLMs）能够解决复杂推理任务是迈向通用人工智能的关键一步。近期研究通过为LLMs增强外部工具以实现智能体推理，以即插即用的方式获得了高效用与高效率。然而，此类方法在工具调用过程中易受恶意操纵的内在脆弱性在很大程度上仍未得到充分探索。在本工作中，我们识别出一种针对工具的攻击面，并提出了海绵工具攻击（STA）。该攻击在严格的仅查询访问假设下，仅通过重写输入提示即可破坏智能体推理。无需对底层模型或外部工具进行任何修改，STA即可将原本简洁高效的推理轨迹转化为在得出最终答案前不必要的冗长且复杂的路径，从而在保持原始任务语义和用户意图以实现隐蔽性的同时，造成显著的计算开销。为实现此目标，我们将STA设计为一个具有显式重写策略控制的迭代式多智能体协作框架，能够以高语义保真度从原始提示生成看似良性的提示重写。我们在6个模型（包括开源模型和闭源API）、12种工具、4种智能体框架以及涵盖5个领域的13个数据集上进行了广泛实验，验证了STA的有效性。