New bypass vector in the wild. Attackers are registering tools with names containing unicode homoglyphs to spoof legitimate ones.

Example:
* Legitimate tool: `send_email`
* Spoofed tool: `send_еmail` (uses Cyrillic 'е')

The agent's tool dispatcher does a simple string match. To a human, they look identical. The spoofed tool gets executed with user-granted permissions.

Immediate mitigation:
* Normalize tool names to ASCII before comparison.
* Implement an allowlist of approved tool identifiers.

Long term, this needs a schema validation step. The operator's trust in tool names is currently misplaced.

Relevant for any agent framework using dynamic tool calling, not just OpenAI's. Check your deployments.