# InjecAgent

Tool-using language-model agents can pick the intended tool yet execute an injected argument, and existing counterfactual guards lose source sensitivity when they score with a reasoning prefix that already encodes the injected decision. BiCP removes the current-step reasoning prefix before scoring, probes both the tool-name target and the complete-call target, and routes proposals by operation risk. On a 922-case fixed replay, the full method reduces confirmed InjecAgent attacks from 83/682 to 0/682 and unsafe conditional executions from 33/240 to 0/240, while benign task success rises from 66/120 to 78/120.

Tool-using language-model agents can pick the intended tool yet execute an injected argument, and existing counterfactual guards lose source sensitivity when they score with a reasoning prefix that already encodes the injected decision. BiCP removes the current-step reasoning prefix before scoring, probes both the tool-name target and the complete-call target, and routes proposals by operation risk. On a 922-case fixed replay, the full method reduces confirmed InjecAgent attacks from 83/682 to 0/682 and unsafe conditional executions from 33/240 to 0/240, while benign task success rises from 66/120 to 78/120.