The tools an agent can call define its blast radius. Even without code flaws, an agent manipulated by input, or one that misunderstands its task, can call a payment, email, or database tool with harmful arguments. Chaining several permitted tools can produce an effect that none of them would allow on its own.
Grant each agent the least agency it needs: allowlist tools per task, validate tool parameters against strict schemas, set rate and spend limits, separate read and write tools, and require confirmation for destructive or external-facing calls.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2026Latest
#02asi02-2026 Tool Misuse and Exploitation
