The authoritative source for this module. ASI02 definition, attack scenarios (Tool Poisoning, Indirect Injection → Tool Pivot, Over-Privileged API, Tool Chaining exfil, Typosquatting, EDR Bypass via Tool Chain, Approved Tool Misuse), and all eight mitigations are sourced directly from this document.

Demonstrated a 0-click exploit against Microsoft Copilot Studio exploiting over-broad tool defaults to exfiltrate user data without any required user interaction. Cited in the OWASP ASI02 references as a key real-world example of Type 1 (Over-Privileged Tool) exploitation.

Documented attack against Amazon Q Developer where a prompt injection caused the agent to exfiltrate secrets by encoding them in DNS query hostnames — using the agent's legitimate network access tools. Demonstrates that any tool generating outbound network traffic is a potential covert exfiltration channel. Cited in OWASP ASI02 references.

Invariant Labs demonstrated a prompt injection in GitHub's MCP server where malicious content hidden in a public repository's tool metadata caused an AI assistant to exfiltrate private repository data when the tool was invoked. Demonstrates tool descriptor poisoning as an attack vector in the MCP ecosystem.

Early AutoGPT incidents demonstrated how agents with unrestricted filesystem and shell execution tools perform unintended destructive actions within their authorized scope — a foundational case study for the ASI02 misalignment scenario (Scenario 07). Cited in the OWASP ASI02 references.

Research on programmatic privilege control mechanisms for LLM agents — relevant to the Least Privilege (MIT 01) and Intent Gate (MIT 04) mitigations discussed in this module.

The open standard for dynamic tool discovery and connection in AI agent systems. Understanding MCP is essential context for ASI02 because dynamic tool discovery dramatically expands the attack surface for tool descriptor poisoning and tool name impersonation attacks.

Introductory agent-building tutorial that illustrates the risks of unconstrained tools, identity-less execution, and overly permissive agent capabilities — relevant context for why ASI02 is so common in early-stage agentic deployments.

This module is an independent educational resource. It is not affiliated with, endorsed by, or sponsored by OWASP or any of the organizations whose research is cited above. All trademarks and product names are the property of their respective owners. Real incident descriptions are based on publicly available security research disclosures and may not reflect the full technical details of the original findings.