AG02:2026 — Tool Misuse and Exploitation

Slide 26 · The Matrix

Which mitigations stop which attacks

A practitioner map — real attacks on the left, the controls that address them across the top.

📄 OWASP Top 10 for Agentic Applications 2026 · ASI02

Attack / Scenario	M1 Least priv.	M2 Action auth.	M3 Sandbox	M4 Intent gate	M5 Budget	M6 JIT access	M7 Semantic+log
AgentFlayer — 0-click Copilot Studio exfilOver-broad tool defaults → data forwarded	✓	✓	~	✓		~	✓
Amazon Q — Secrets via DNSPrompt injection → secrets encoded in DNS queries	~		✓	✓	~	✓	✓
MCP Tool Descriptor Poisoning — GitHubMalicious descriptor metadata → private repo exfil	✓	✓	~	✓			✓
EDR Bypass — Tool Chain (PowerShell + cURL)Injected instruction → legitimate tools exfil logs	✓	~	✓	✓		~	✓
DNS Ping Exfil — Approved tool as covert channelAgent pings hostnames encoding stolen data	✓		✓	✓	✓		✓
CRM + Email Chain (S04)CRM query chained with external email → data exfil	✓	✓	~	✓		✓	✓
Loop Amplification (S09)Agent calls costly API in unbounded loop → DoS/bill				~	✓		✓

How to read this

✓ = this mitigation directly addresses the attack vector or limits its impact. ~ = partial coverage. Empty = does not address this path.

MIT 01 (Least Privilege) and MIT 04 (Intent Gate) cover the most attacks. If you can only implement two, start there. MIT 03 (Sandbox) + MIT 07 (Monitoring) form the best detection and containment layer. MIT 05 (Budget) is the only control that reliably stops loop amplification.

← Back Test what you know → Quiz