ChronosAttack: Adversarial Tool Scheduling Attacks on LLM Agents

Abstract We introduce ChronosAttack, an attack on large language model (LLM) agents that changes only when authentic tool results arrive. When an agent invokes several tools in parallel, the runtime may pass each result to the model as soon as it arrives. Tool completion times then determine the order in which the model reads the evidence. ChronosAttack exploits this behavior by delaying results without changing their contents or adding or removing observations. Checks that inspect output content alone therefore have no altered payload to flag. We formalize this delay-only threat model and consider a fixed attacker, which chooses a delivery order in advance, and an adaptive attacker, which tests orders using observed decisions. We distinguish order sensitivity, the dependence of a decision on evidence order, from steering, the attacker's ability to move a decision toward a chosen option. Using controlled replay on synthetic decision tasks, we evaluate both properties and compare defenses that change how agents receive or combine tool results. We assess these defenses by their resistance to steering and their effect on decisions in the absence of an attack.