Slide 4 · The Definition Part 2
The thing that makes ASI02 different from every other AI tool problem
The agent is operating within its authorized permissions. That's exactly what makes this dangerous.
📄 OWASP Top 10 for Agentic Applications 2026 · ASI02
The critical distinction
ASI02 covers cases where "the agent operates within its authorized privileges but applies a legitimate tool in an unsafe or unintended way."
The agent isn't breaking any rules it knows about. The tool call succeeds. The audit log shows an authorized action. Everything looks normal from the outside.
Agent uses a tool it's allowed to use
Tool executes successfully
Authorization check passes
The purpose is wrong, not the permission
Example: refund bot issuing fraudulent refunds
Privilege escalation (that's ASI03)
Running injected code (that's ASI05)
A compromised tool at install time (that's ASI04)
A stolen credential or token (that's ASI03)
The tool itself being malicious
One line to remember
In every other security risk, something unauthorized happened. In ASI02, everything was authorized — and that's why traditional security controls missed it.