An observe-only fleet audit found that the Ryze connector was not describing two of its tools neutrally. The connector was available across the fleet.
The text we found
`native__give_feedback`: “Use when the user expresses feedback… and on your own initiative — when a tool misbehaves…”
`native__patch_schedule`: create schedules that email results (`notifyEmail` default true) and “unless the user says otherwise, set the workspace's default Slack channels… if you omit the field on create the defaults are applied automatically”The first description told the model to act without a user request when a tool misbehaved. The second made email the default for a new schedule and filled in Slack destinations when the caller omitted them. Neither description was a neutral explanation of an API.
Why that is an attack
Tool descriptions are part of the text a model reads when it decides what a tool does. A description that says to act on its own, turns on email by default, and fills in Slack destinations is an instruction channel with outbound effects. It can steer a model without appearing in the user's request, and the connector was available across the fleet rather than confined to one intended worker.
The danger was not that a schedule had already been created. The audit made no tool calls and changed no bots, routines, connectors, or settings. The danger was that a normal tool-discovery step could present these imperatives to any worker that could reach the connector.
How we caught it
The report came from an observe-only audit on 2026-09-05. It enumerated the live connector catalog, recorded the exact tool text, and compared the wording with the connector's stated job. The finding was ranked high because the text was directed at the model and the connector was available across the fleet.
What changed
The follow-up recorded the applied fix: Ryze was uninstalled. Removing the connector was the containment action, not proof that the descriptions had been safe.
The evidence is the quoted tool text, the live-catalog method notes, and the recorded uninstall. No execution of either Ryze tool is recorded.