Tool Misuse
- Tools & External Data
Attackers manipulate an agent into abusing its already-granted tools through deceptive prompts, chaining otherwise-legitimate tool calls into an unauthorized sequence while staying within its nominal permissions.
What it is
Tool misuse manipulates an agent into abusing tools it was already, legitimately granted — through a deceptive prompt or a manipulated data source — chaining calls that are each individually authorized into a sequence its owner never intended. Because every call stays inside the agent's nominal permission scope, the attack leaves no permission violation to flag; what changed is the sequence and intent, not the access level, which is what makes it hard to catch with permission checks alone. A related failure mode is agent hijacking, where adversarial content the agent ingests as ordinary data — not a direct instruction — is what redirects which tools it calls next. The threat partially overlaps Excessive Agency (LLM06), but an agentic system widens the exposure that entry describes: an agent's persistent memory lets a manipulation compound across sessions rather than staying scoped to one call, and its ability to delegate to other agents turns a single successful misuse into a chain the original attacker never has to touch directly.
Attack scenarios
An attacker tricks a customer-service agent into chaining its own record-lookup and email tools to extract high-value customer records and exfiltrate them, without the agent ever exceeding its granted tool scope.
Parameter pollution
An attacker discovers a booking agent's function-call schema and manipulates its parameters to reserve 500 seats instead of one, turning a legitimate function call into a costly overbooking.
Automated phishing at scale
A document-processing agent is tricked into generating and mass-distributing malicious documents, unknowingly executing a large-scale phishing campaign entirely within its authorized document tools.
Hijacking via poisoned memory
An attacker injects false information into an agent's persistent memory so it later recalls and acts on the manipulated data, bypassing security checks across sessions without a single suspicious tool call in isolation.
Hijacking via a poisoned vector store
An attacker seeds a vector database the agent retrieves from with adversarially crafted content, so ordinary retrieval feeds the agent misleading context that drives an unsafe tool call.
Mitigations
- Bound and verify every call
- Permission-scoped Tools cap what each tool can reach, and function-level authentication verifies a call before it runs, not just authorizes it in principle.
- Keep the tool surface small and observable
- A vetted Tool Registry paired with Capability Routing keeps the set of reachable tools bounded and legible, rather than letting an agent accumulate broad, rarely-audited access over time.
- Watch the sequence, not just the call
- Monitor for command chaining that circumvents intended policy and flag abnormal call frequency — the Audit Trail's execution logs are what makes a chained-but-individually-legitimate sequence detectable after the fact.
- Gate high-stakes actions
- Require explicit human approval for tool calls touching financial, medical, or administrative functions, per HITL Approval Gate.