Tool poisoning

Prompt injection hidden in a tool's description. The model reads every description on every step, even for tools it never calls.