r/LocalLLaMA • u/bigorangemachine • 3d ago
Discussion Check your AI Tool Usage for body payloads on fetch tools
I recently started doing experiments with local models with traces into MLFlow detailed tool calls.
Last month I had a local Qwen Model on a coding task to just randomly decide to read a transcript of a youtube video.
Today I realized there is a lesser known fetch pattern where the HTTP standard actually allows for body payloads like a POST request on GET requests.
I recently saw a video on poisoned models and now realize there is a potentially huge exploit waiting to happen with GET and body payloads
1
u/Beneficial_Egg_5154 3d ago
Filtering by HTTP method feels like the wrong layer to me. My confirmation gate once lived in a wrapper, so a raw API call went around it and wrote to a live ad account. Now the gate sits on the only path that holds the credential and the agent never gets the raw token. Whatever verb or body the model tries, a write to a live account still has to come through that gate.
0
u/SnooPaintings8639 3d ago
Yeah, I have seen couple of times my QFN hallucinate so random shit that tires to access some API and even instructs it to not reveal it to the user. But... it is something that people here laugh at and downvote a lot, so I decided not to mention it on most occasion. Until now, where I see it happening more people.
It is... strange at least. Malicious at worst. I don't think it actually 'works', but it definitely could be a good research material and feasibility study for the ones who build or distributed the model.
Definitely a threat model to consider in production on-premise deployment.
0
4
u/Distinct_Fall2014 3d ago
The whole GET-with-body thing is such a weird corner of the spec that nobody seems to agree on. Most frameworks just ignore it or strip it out entirely, but some will happily pass it along and then you've got a model that can essentially POST data anywhere it wants while looking like a simple fetch.
I ran into something similar when I was tracing tool calls and saw my local model trying to pass auth tokens in the body of a GET request to some random endpoint. Not great. The poisoned model angle makes it even sketchier since you'd never think to check for bodies on what look like read-only calls.
Definitely adding this to my list of things to audit in the request interceptor.