In AG02, the agent didn't need to steal anything. It had legitimate API access from day one. No credential theft, no session hijacking — just a tool being called with the wrong intent.
If the attack required gaining access rights the agent wasn't supposed to have, that's a different risk entirely. AG02 is specifically about misusing access the agent already legitimately holds.
In AG02, the agent didn't download malware or execute a script that compromised a host. The tools being misused are normal API calls — send email, query database, process refund, make a network request.
If the end result was arbitrary code running on a production server, that's a different and more severe outcome. AG02 stays at the tool-call level.
A chatbot giving a wrong or harmful answer is a problem — but it's a one-time output that a human can see and discard. AG02 is about what the agent did: money moved, data was sent, records were deleted. The harmful output was an action in the world, not a sentence on screen.
AG02 is: the agent used a tool it was authorized to use, in a way it was never supposed to, and that action had real consequences. No stolen access. No injected malware. No privilege it wasn't given. Just the wrong use of the right tool.