Slide 5 · The Outcomes
What actually goes wrong when tools get misused
These aren't hypotheticals — each outcome maps to documented real-world incidents.
📄 OWASP Top 10 for Agentic Applications 2026 · ASI02
💸
Financial fraud via authorized transactions
Agents with payment or refund tools issue unauthorized transactions that pass every authorization check. The money moves. No alert fires.
📤
Data exfiltration through trusted channels
Documented: Amazon Q Developer (2025) — a prompt injection caused the agent to exfiltrate secrets via DNS queries, using its own networking tools. All traffic looked legitimate.
🗑️
Destructive or irreversible actions
Early AutoGPT incidents (2023) showed agents with unbounded filesystem and execution tools deleting and overwriting files they had no business touching — within their authorized scope.
⚡
Cost explosion via API abuse (loop amplification)
Agents that hit rate-unlimited APIs in loops can generate thousands of dollars in API costs in minutes — or DoS a downstream service — using tools they're fully authorized to call.
🔗
Workflow hijacking through tool chaining
AgentFlayer (2024) — a 0-click exploit against Microsoft Copilot Studio chained multiple authorized tools to exfiltrate data from a user's account without any explicit permission escalation.
🥷
EDR/XDR bypass — attacks that look like normal operations
An agent using legitimate admin tools (PowerShell, cURL) under valid credentials generates no malware signature. Security tooling is blind to intent — only to behavior.