AG02:2026 — Tool Misuse and Exploitation

Slide 9 · Two Types Overview

Two paths to the same outcome — tools doing things they shouldn't

ASI02 exploits show up in two distinct forms. The defenses are different for each.

Type 1 — Over-Privileged Tools

What it is: The tool has more capability than the agent's task actually requires

How it's exploited: Attacker triggers the tool for any reason — the excess capability does the damage

Example: Email summarizer can also send and delete mail

Root cause: Tool was scoped to what it can do, not what this agent should do

Type 2 — Tool Chaining and Injection

What it is: An attacker sequences multiple legitimate tools into an unintended attack chain

How it's exploited: Each individual tool call looks normal; the sequence is the attack

Example: DB read → external email → customer data exfiltrated

Root cause: No policy validates whether this sequence of tool calls makes sense together

Why both matter

Type 1 attacks are easier to defend against — reduce tool permissions. Type 2 attacks are harder — you need to understand sequences of calls, not just individual calls. Most mature deployments focus on Type 1 and underestimate Type 2.

Real attacks often combine both: an over-privileged tool is chained with another tool to create a path the developer never considered.

← Back Let's go deeper → Type 1 first: Over-Privileged Tools