AG02:2026 — Tool Misuse and Exploitation

Slide 13 · Type 2 — Real Example

EDR bypass via tool chaining — security tooling, used as the attack

When legitimate admin tools become the exfiltration pipeline, endpoint detection is blind.

Real Attack Pattern · Documented 2024–2025

EDR Bypass via Tool Chaining (Security Automation Agents)

A security-automation agent receives an injected instruction — embedded in a log file it was parsing — that causes it to chain together three legitimate administrative tools: PowerShell (query internal logs), cURL (format and transmit data), and an internal API (authenticate the request using valid credentials).

Each tool is used by legitimate security workflows every day. PowerShell runs constantly. cURL calls are routine. The API endpoint is authorized. Because every command is executed by trusted binaries under valid credentials, the host-centric monitoring (EDR/XDR) sees no malware, no exploit, no unauthorized process.

The security logs are exfiltrated. The EDR never fires. The SIEM has no matching rule — because the individual actions it saw were completely normal.

Lesson: EDR and XDR tools detect malicious behavior patterns based on known attack techniques — not intent. An agent conducting an attack through authorized, legitimate tools generates no behavior that matches those patterns. Tool-level monitoring must be augmented with intent-level controls.

Documented Technique · Invariant Labs 2025

MCP Tool Descriptor Poisoning — GitHub Integration

Invariant Labs demonstrated a prompt injection in GitHub's MCP server where a malicious public repository embedded commands in its tool metadata (the descriptor the agent reads to understand what the tool does). When an assistant invoked the tool, it read the poisoned descriptor and exfiltrated private repository data — including code and secrets — without user knowledge.

The tool was fully legitimate. The MCP server was the official GitHub integration. The attack lived in the tool's own description of itself.

Lesson: Tool metadata is an attack surface. Agents that trust tool descriptors without validation can be made to perform any action the descriptor instructs — regardless of what the tool was originally designed to do.

← Back Let's see more scenarios →