ai-agent-tool-abuselisted

# LLM agent / tool abuse (excessive agency) ## When it applies The target isn't just a chatbot — it can *act*: call functions, browse, run code, query databases, send email, hit internal APIs, or chain MCP tools. Impact jumps from "bad text" to real actions taken with the agent's privileges. ## Why it works The model decides which tool to call and with what arguments, driven by text it can't fully trust (user input or fetched content). If tools are over-permissioned or arguments aren't validated, attacker text steers real actions — the classic "confused deputy". ## Method 1. **Enumerate the tools**: get the agent to reveal its tools/functions and schemas (often it just lists them), or read the app/MCP config. 2. **Coerce a call** (direct or via `ai-prompt-injection`/`ai-rag-poisoning`): craft input so the agent invokes a tool with your arguments. 3. **Route to impact**: - **SSRF/internal reach**: a browse/fetch tool → internal URLs, cloud metadata (→ `cloud-imds-ssrf`). - **RCE**: a code-interpreter/shell tool → command execution. - **Data exfil**: a query/email/file tool → dump data to you (markdown-image beacon, an email to your address). - **Privilege abuse**: an admin/action tool called on behalf of a victim (confused deputy). 4. **Chaining**: poisoned content the agent reads later triggers the tool call (indirect, multi-user). ## Gotchas - The severity is the *action*, tied to the tool's real privilege — demonstrate the effect, not just intent. - Gu