"Agents can misuse legitimate tools due to prompt injection, misalignment, or unsafe delegation or ambiguous instruction — leading to data exfiltration, tool output manipulation or workflow hijacking."
An attacker embeds instructions in content the agent is reading — a document, a web page, an email, an API response. The agent treats those instructions as legitimate commands and uses its tools accordingly. In the refund example on slide 1, the hidden instruction was a prompt injection.
The agent does something unintended not because of an attacker, but because its instructions were ambiguous or incomplete. A coding agent told to "clean up the repository" might delete files the developer still needed. No attack. Just a tool invoked beyond its intended scope.
When one agent delegates a task to another, it may pass along its full tool permissions — even if the sub-agent only needs a small subset. A high-privilege orchestrator delegates to a narrow worker agent, which then has more capability than it should.