Tool Misuse and Exploitation — An agent uses a legitimate tool in a way nobody intended, or is induced to invoke one it should never have reached.
One of the ten risks in the OWASP Top 10 for Agentic Applications 2026. Below: how it actually shows up in production, the controls that address it, the evidence object that proves each control fired, and what these controls genuinely cannot do.
Get an Agent Trust Gap BriefHow it shows up
Rarely an exploit in the classic sense. Usually a tool granted for one narrow purpose being composed into something else — a read tool chained into enumeration, a write tool used at volume, a payment tool called in a loop. The permission was real; the use was not foreseen.
Controls that address it
- Per-tool authorization, scoped at the tool rather than the server.
- Explicit deny lists — 'not mentioned' and 'forbidden' must never be the same state.
- Rate and volume ceilings per tool, per agent, per window.
- Autonomy budget that refuses at the limit rather than throttling toward it.
- Argument-level policy, not just tool-level: which tool AND with what.
The evidence that proves the control fired
An execution_receipt carrying the tool, the argument hash, the policy version and the gates passed — so misuse is reconstructable rather than inferred.
Schema: ApexClaw Receipts v1 — the receipt format used inside our governance audit, not a standalone protocol or ratified standard (CC-BY, DRAFT).
Honest limitation
Argument-level policy is where this gets expensive. Most teams enforce at the tool and accept the gap. That is a defensible trade-off only if it is written down as one.
Interpretation Control mappings are ApexClaw's reading of the published OWASP text, last verified 2026-08-06. Source: OWASP Top 10 for Agentic Applications 2026. Not legal advice, not a compliance determination. Full crosswalk →
← ASI01 Agent Goal Hijack ASI03 Identity and Privilege Abuse →
Common questions
What is ASI02 tool misuse and exploitation?
ASI02 tool misuse and exploitation — The agent uses a legitimate tool in an unintended or damaging way — right credential, wrong call.
How do you defend against it?
Scope tools to actions rather than systems, validate arguments at the boundary, and apply per-tool rate and value caps so misuse hits a ceiling.
Is the OWASP Agentic Top 10 a certification?
No. It is a risk taxonomy, not a certifiable standard. There is no OWASP certification for it. Its value is as shared vocabulary — see the assurance frameworks comparison.
What evidence shows this control is working?
Refusal receipts. A control that has never blocked anything is either untested or not enforced. Countable refusals with reasons are what turn a claimed control into a demonstrated one.