Threat T2
Tool Misuse
Manipulation of tools, APIs, or environment access to perform unintended actions or access unauthorized resources, including exploitation of access to external systems.
- 8/10 risk (Critical)
- 6 attack vectors
- 11 mitigating controls
- 7 framework refs
Overview
- Impact level: High
- Risk score: 8/10 (Critical)
- CIA impact: Confidentiality, Integrity, Availability
- Affected components: Tool Integration Layer (KC5.1-KC5.4); External Environment Interface (KC6.1-KC6.3)
- Tags: tools, api, manipulation, access-control, sandbox
- Source: OWASP Agentic AI T&M v1.1 (2025-12)
Attack vectors
How attackers carry out tool misuse against an agentic system.
| Attack vector | Severity | Example |
|---|---|---|
| Prompt Injection for Tool Abuse | High | Manipulating agent to execute unauthorized tool commands |
| Tool Chain Exploitation | High | Chaining multiple tool calls to achieve unauthorized outcomes |
| API Parameter Manipulation | Medium | Modifying tool parameters to access restricted resources |
| Tool Authentication Bypass | High | Exploiting tool authentication mechanisms |
| Resource Exhaustion via Tools | Medium | Using tools to overwhelm external services |
| Lateral Movement through Tools | High | Using legitimate tools to access unintended systems |
Affected components
KC5 Tool Integration Frameworks
KC6 Operational Environment (Agencies)
- KC6.1 API Access
- KC6.1.1 Limited API Access
- KC6.1.2 Extensive API Access
- KC6.2 Code Execution
- KC6.2.1 Limited Code Execution Capability
- KC6.2.2 Extensive Code Execution Capability
- KC6.3 Database Execution
- KC6.3.1 Limited Database Execution Capability
- KC6.3.2 Extensive Database Execution Capability
- KC6.3.3 Agent Memory or Context Data Sources (RAG)
- KC6.4 Web Access Capabilities (Web-Use)
- KC6.5 Controlling PC Operations (PC-Use)
- KC6.6 Operating Critical Systems
- KC6.7 Access to IoT Devices
Mitigating controls
Controls from the catalog that reduce the likelihood or impact of T2.
M2 Tool Sandboxing & Isolation
Implement defense-in-depth isolation for tool execution environments using containerization, virtualization, and strict resource controls to prevent tool misuse, contain breaches, and prevent unexpected code execution.
M6 Comprehensive Security Monitoring & Auditing
Implement end-to-end observability with security-focused monitoring, anomaly detection, tamper-evident logging, and advanced threat hunting to ensure accountability, enable incident response, and detect rogue agents.
M7 Zero Trust & Least Privilege Access
Implement fine-grained access controls with continuous verification, temporary credentials, minimal permission sets, and dynamic privilege management following zero trust principles to prevent tool misuse, privilege compromise, and unauthorized code execution.
M9 Distributed Resource Management & Rate Limiting
Implement multi-layer resource controls with intelligent quotas, circuit breakers, cost management, and distributed rate limiting to prevent resource exhaustion, financial damage, and denial of service attacks while maintaining system performance.
M10 Defense-in-Depth Architecture & Trust Boundaries
Implement multiple security layers with clear trust boundaries, network segmentation, cryptographic verification, and zero-trust networking to contain breaches, prevent lateral movement, and protect against privilege compromise, identity spoofing, and rogue agents.
M12 Secure Model Training & Validation
Comprehensive security practices for model training pipelines including data integrity verification, training environment hardening, model validation against adversarial inputs, and ensuring reproducibility of training processes.
M13 Secure Development Lifecycle Integration
Embed security practices throughout the AI and agent lifecycle with security design reviews, automated testing gates, dependency scanning, and continuous compliance checks.
M14 Runtime Security Controls & Sandboxing
Implement comprehensive runtime security controls including advanced sandboxing, execution monitoring, and dynamic security policy enforcement to prevent unexpected code execution and contain security breaches in real-time.
M17 Supply Chain Security & Provenance
Implement comprehensive supply chain security including model provenance verification, dependency management, secure development environments, and third-party component validation to prevent supply chain attacks and ensure component integrity.
M18 Incident Response & Recovery Framework
Implement comprehensive incident response capabilities specifically designed for agentic AI systems, including automated containment, forensic analysis, recovery procedures, and lessons learned integration to rapidly respond to security incidents and minimize impact.
M19 MCP Server Hardening & Tool Provenance
Treat every MCP server, A2A peer and tool definition as an untrusted, versioned dependency: admit only allow-listed and verified servers, authenticate and authorize every protocol request, validate and screen tool metadata and results before they reach the model, and require re-approval when a tool definition changes.
Framework mappings
OWASP Top 10 for Agentic Applications
Cisco AI Security Taxonomy
OWASP AIVSS core risks
- AIVSS #2 Agentic AI Tool Misuse AIVSS 9.9 (Critical)
- AIVSS #4 Agent Supply Chain and Dependency Risk AIVSS 9.7 (Critical)
- AIVSS #1 Agent Orchestration and Multi-Agent Exploitation AIVSS 10.0 (Critical)
- AIVSS #7 Insecure Agent Critical Systems Interaction AIVSS 9.2 (Critical)
OWASP AISVS
Chapters cited by the mitigating controls: C1 Training Data Integrity & Traceability, C2 Input Validation, C3 Model Lifecycle Management & Change Control, C4 Infrastructure, Configuration & Deployment Security, C5 Access Control & Identity for AI Components & Users, C6 Supply Chain Security for Models, C8 Memory, Embeddings & Vector Database Security, C9 Orchestration & Agentic Security, C10 Model Context Protocol (MCP) Security, C11 Adversarial Robustness, C12 Monitoring, Logging & Anomaly Detection.
Requirements: C9.1.1, C9.3.1, C9.3.3, C9.3.4, C9.3.5, C9.3.6, C9.3.9, C4.1.1, C10.1.3, C12.1.1, C12.1.2, C12.1.3, C12.1.4, C12.2.1, C12.2.2, C12.4.2, C12.4.3, C12.5.3, C9.4.2, C5.1.1, C5.1.2, C5.2.1, C5.2.2, C5.2.5, C5.2.6, C9.5.1, C9.5.2, C9.5.3, C9.5.6, C9.5.7, C9.1.2, C9.1.3, C11.2.2, C12.2.5, C2.1.4, C5.3.1, C1.3.1, C1.3.5, C3.2.1, C3.2.2, C3.5.1, C3.5.2, C11.1.1, C11.1.2, C11.1.3, C11.2.4, C3.1.1, C3.3.1, C3.4.1, C3.4.2, C6.1.4, C4.1.2, C4.1.3, C4.3.3, C9.3.8, C9.6.1, C6.1.1, C6.1.2, C6.1.3, C6.2.1, C6.2.2, C6.2.3, C3.1.2, C3.1.3, C1.1.2, C9.6.3, C3.3.2, C8.3.2, C10.1.1, C10.1.2, C10.2.1, C10.2.4, C10.2.5, C10.2.7, C10.3.1, C10.3.3, C10.4.1, C10.4.2, C10.4.7, C10.4.8, C9.3.7, C9.5.5.
MITRE ATLAS
- AML.T0010 Supply Chain Compromise
- AML.T0011 User Execution
- AML.T0011.003 User Execution: Malicious Link
- AML.T0050 Command and Scripting Interpreter
- AML.T0053 AI Agent Tool Invocation
- AML.T0067 LLM Trusted Output Components Manipulation
- AML.T0094 Delay Execution of LLM Instructions
- AML.T0095 Search Open Websites/Domains
- AML.T0099 AI Agent Tool Data Poisoning
- AML.T0101 Data Destruction via AI Agent Tool Invocation
- AML.T0110 AI Agent Tool Poisoning
Attack walkthroughs
- Over-Privileged API: A customer service bot intended to fetch order history also issues refunds because the tool had full financial API access.
- MCP Tool Descriptor Poisoning: A prompt injection in GitHub's MCP where a malicious public tool hides commands in its metadata; the assistant exfiltrates private repo data.
- T2 (Tool Misuse) in Sequential: Even with limited API access (KC6.1.1), an attacker can exploit this capability.
- T2 (Tool Misuse) & T11 (Unexpected RCE) in Reactive: The rapid action-taking nature of reactive agents creates risks when tools are invoked quickly without thorough validation.
References
Source: OWASP Agentic AI – Threats and Mitigations 1.1 (Dec 2025) · retrieved 2026-11