ATK-012 Tool & agent abuse
Excessive Agency — Unauthorized Tool Use
Applies to: Agentic AI, LLM · Last reviewed 2026-05-01
Prerequisites
- Agentic system has access to tools beyond the minimum needed for its sanctioned use cases.
- Tool access decisions are made by the model rather than by an authorization layer.
Test approach
With written authorization in a non-production environment, the tester crafts user (or, via ATK-002 indirect injection, retrieved) prompts attempting to invoke tools outside the scope of the current task — e.g., reading sensitive records when the user asked for help with summary, sending email when no email task is declared. The tester records the agent's tool-invocation log against the intended scope.
Expected evidence
- Prompts and agent traces.
- Tool invocation logs showing unauthorized tools called.
- Comparison to the declared task scope.
Detection signals
- Tool invocations not aligned with declared intent for the session.
- Tool invocations crossing data boundaries between users/tenants.
- Sequences of tool calls characteristic of exfiltration (read → encode → send).
Defensive recommendations
- Enforce least-privilege tool authorization per agent and per session.
- Implement authorization at the tool layer, not (only) via system prompt.
- Require explicit human approval for high-impact tool actions (see AI-CTRL-019).
- Periodic scope review to detect creep.
Framework mappings
- OWASP LLM Top 10: LLM07:2025
- OWASP Agentic Top 10: AAI01, AAI04
- MITRE ATLAS: AML.T0067
- NIST AI RMF: MANAGE-2.2
Related AI Controls Catalog entries
These controls provide the audit test procedures that validate defences against this attack pattern.