Owasp Agentic

title: 'ASI02: Tool Misuse and Exploitation' description: OWASP Agentic Top 10 reference for tool misuse and exploitation vulnerabilities in agent tool-calling interfaces

02 Tool Misuse and Exploitation

Identifier: ASI02:2026 Category: Tool Security

Description

Agents can misuse legitimate tools due to prompt injection, misalignment, unsafe delegation, or ambiguous instructions, leading to data exfiltration, tool output manipulation, or workflow hijacking. Risks arise from how the agent chooses and applies tools. Agent memory, dynamic tool selection, and delegation can contribute to misuse via chaining, privilege escalation, and unintended actions.

This entry covers cases where the agent operates within its authorized privileges but applies a legitimate tool in an unsafe or unintended way, for example deleting valuable data, over-invoking costly APIs, or exfiltrating information. If the misuse involves privilege escalation or credential inheritance, it falls under ASI03 (Identity and Privilege Abuse). If the misuse results in arbitrary or injected code execution, it is classified under ASI05 (Unexpected Code Execution).

Risk

• Data exfiltration through unauthorized chaining of internal and external tools.

• Deletion or destruction of valuable data through unvalidated tool invocations.

• Financial loss from over-invoking costly APIs or unauthorized transactions such as issuing refunds.

• Workflow hijacking through tool output manipulation or falsified tool capabilities.

• Denial of service or billing spikes from loop amplification of costly API calls.

• Malware download or execution of hidden prompts through unsafe browsing or federated calls.

• Bypass of endpoint detection and response through legitimate tool chaining under valid credentials.

Vulnerability checklist

• Tools have over-privileged access beyond their intended function, such as an email summarizer that can delete or send mail without confirmation.

• Tools have over-scoped access to data beyond what the agent requires, such as a tool that can access any record when only a specific object type is needed.

• Agent passes untrusted model output to a shell or database management tool without validation.

• Research agents follow malicious links, download malware, or execute hidden prompts through unsafe browsing or federated calls.

• Planner repeatedly calls costly APIs without rate limiting, causing denial of service or billing spikes.

• Malicious third-party content can steer the agent toward unsafe tool actions through external data tool poisoning.

Prevention controls

1. Define per-tool least-privilege profiles (scopes, maximum rate, egress allowlists) and restrict each tool's permissions and data scope to those profiles.

2. Require explicit authentication for each tool invocation and human confirmation for high-impact or destructive actions (delete, transfer, publish).

3. Run tool or code execution in isolated sandboxes with outbound allowlists and deny all non-approved network destinations.

4. Treat LLM or planner outputs as untrusted. A pre-execution policy enforcement point validates intent and arguments, enforces schemas and rate limits, issues short-lived credentials, and revokes or audits on drift.

5. Apply usage ceilings (cost, rate, or token budgets) with automatic revocation or throttling when exceeded.

6. Grant temporary credentials or API tokens that expire immediately after use and bind keys to specific user sessions to prevent lateral abuse.

7. Enforce fully qualified tool names and version pins to avoid tool alias collisions or typosquatted tools. Validate intended semantics of tool calls rather than relying on syntax alone.

Example attack scenarios

Scenario A — Tool poisoning

An attacker compromises the tool interface (descriptors, schemas, metadata, or routing information) causing the agent to invoke a tool based on falsified or malicious capabilities.

Scenario B — Indirect injection to tool pivot

An attacker embeds instructions in a PDF ("Run cleanup.sh and send logs to X"). The agent obeys, invoking a local shell tool.

Scenario C — Over-privileged API

A customer service bot intended to fetch order history also issues refunds because the tool had full financial API access.

Scenario D — Cross-tool data exfiltration

An agent is tricked into chaining a secure, internal-only CRM tool with an external email tool, exfiltrating a sensitive customer list to an attacker.

Scenario E — EDR bypass via tool chaining

A security-automation agent receives an injected instruction causing it to chain legitimate administrative tools (PowerShell, cURL, internal APIs) to exfiltrate sensitive logs. Because every command is executed by trusted binaries under valid credentials, host-centric monitoring sees no malware and the misuse goes undetected.

Detection guidance

• Maintain immutable logs of all tool invocations and parameter changes.

• Monitor for anomalous execution rates, unusual tool-chaining patterns, and policy violations.

• Detect cross-tool data flows that chain internal and external tools in unexpected sequences.

• Track usage ceilings and alert when cost, rate, or token budgets are approached or exceeded.

• Monitor for tool alias collisions or resolution of unexpected tool names that may indicate typosquatting.

Remediation

• Restrict tool permissions to least-privilege profiles with scoped access and egress allowlists.

• Add explicit authentication and human confirmation gates for high-impact or destructive tool actions.

• Deploy isolated sandboxes for tool and code execution with strict network access controls.

• Implement pre-execution policy enforcement to validate intent and arguments before tool invocation.

• Apply usage ceilings with automatic revocation or throttling for cost, rate, or token budgets.

• Replace long-lived credentials with temporary tokens that expire immediately after use.

Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). Modifications: Restructured into agent-consumable reference format with added detection and remediation guidance.