When an AI agent needs to do something — send an email, query a database, look up a file, call an API — it uses a tool. Tools are the capabilities you give an agent. They're functions the agent can call.
Examples: a search_web tool, a send_email tool, a process_refund tool, a read_file tool, a run_script tool.
Agents in 2025–2026 often have dozens of tools — and many of them can take real, irreversible actions in the world.
Misuse doesn't mean the tool broke. It means the tool was used for a purpose its owner never intended. The refund tool from slide 1 wasn't misused in the sense that it malfunctioned — it was misused because the agent invoked it under the wrong circumstances, in response to the wrong input, for the wrong person.
Misuse = the right tool, the wrong use.
Exploitation means an attacker intentionally triggered the misuse. They didn't stumble across a bug — they designed an input specifically to cause the agent to call a tool in a way that benefits the attacker.
Exploitation turns a misuse risk into a targeted attack.
Tool Misuse and Exploitation = an attacker causes an AI agent to call one of its authorized tools in a way the agent's designers never intended — and the tool executes successfully.