AG02:2026 — Tool Misuse and Exploitation

Slide 6 · The Attackers

Who exploits tool misuse, and what do they want?

The attacker profile here is different from traditional hacking — and the barrier to entry is lower.

💬

Prompt crafters — no code required

Anyone who knows how an agent works can craft a message designed to trigger an unintended tool call. No vulnerability to find, no exploit to write. Just text.

📄

Content-layer attackers — poisoned documents and pages

Attackers who don't have direct access to an agent can still exploit it indirectly — by embedding instructions in content the agent will later read. PDFs, web pages, emails, calendar invites, API responses.

🏢

Competitors and insiders — financial manipulation

Any party who can interact with an agent that has financial tools is a potential attacker. Customer fraud via refund manipulation. Insider abuse of bulk-action tools. Competitor DoS via loop amplification.

🎯

Security researchers — and organized threat actors who read their work

AgentFlayer, the Amazon Q DNS exfil, and MCP tool descriptor poisoning were all first demonstrated by researchers. Within months of public disclosure, similar techniques appear in the wild.

What all of them want

Money (fraudulent refunds, payment redirects), data (exfiltration via trusted outbound channels), disruption (deleting data, crashing workflows), or stealth persistence (establishing footholds without triggering alerts, because the tools they used were authorized).

The thing they all rely on: you gave the agent more tool power than it needed, or you trusted the input it received without validating it.

← Back Got it → How is this different from prompt injection or privilege abuse?