HOME / SERVICES / AI SECURITY / OWASP TOP 10
ASI02 - TOOL MISUSE AND EXPLOITATION
A support agent has four tools. It can search a customer record, raise a credit, send an email and attach a file. Each one was signed off by a different person on a different day, and each one is defensible on its own. Nobody assessed the sequence. AI agent tool misuse in South Africa is what happens when an attacker supplies the sequence, and Joint Standard 2 of 2024, POPIA and the Cybercrimes Act 19 of 2020 all attach to the result. ASI02 is the second entry in the OWASP Top 10 for Agentic Applications, published 9 December 2025 by the OWASP Agentic Security Initiative, which is vendor neutral and controlled by no security firm.
EVERY PERMISSION WAS APPROVED SEPARATELY. THE ATTACK USED THEM TOGETHER.
DEFINITION
WHAT THIS RISK ACTUALLY IS
An agent without tools is a text generator. An agent with tools is a system that acts. The tools are the whole commercial reason the agent exists: query the database, call the API, move the file, issue the refund, open the ticket, run the script.
Tool misuse is the agent using its legitimate tools to produce an illegitimate outcome. There is no exploit in the classical sense. No buffer is overflowed. The tool works precisely as documented. The agent simply calls it with arguments, in an order, or at a volume, that nobody anticipated when the permission was granted.
DOCUMENTED CASE
WHAT IT LOOKS LIKE IN PRACTICE
The clearest documented illustration of an AI system driving tooling autonomously is Anthropic’s GTG-1002 disclosure of November 2025. A state-sponsored group manipulated an AI model into functioning as an autonomous cyber attack agent, executing 80 to 90% of tactical operations independently against roughly 30 entities. Carry the hedge that Anthropic itself published: the model frequently overstated findings and occasionally fabricated data during autonomous operations. That caveat matters both ways. It tempers the threat, and it tells you exactly how unreliable an autonomous tool-caller is when nobody is checking.
- Here is the pattern in a South African setting, written as an illustration rather than a reported incident.
- 01 - A procurement agent is given three tools: read the supplier master, draft a payment instruction, and send email. Approval thresholds sit in the payment system, above the agent.
- 02 - An attacker emails an invoice. Inside the document is an instruction telling the agent that supplier banking details have changed and must be reconciled before processing.
- 03 - The agent updates the supplier record. That is a permitted write. It was approved because suppliers do change banks.
- 04 - The agent then drafts a payment instruction against the updated record. Also permitted, and below the approval threshold, so no human sees it.
- 05 - Nothing was hacked. Two approved tools, called in an order nobody modelled, moved money to an attacker.
- 06 - Gartner forecasts that over 40% of agentic AI projects will be cancelled by the end of 2027. Projects that never scoped tool permissions are strong candidates.
WHAT THIS MEANS UNDER SOUTH AFRICAN LAW
The SARB, FSCA and Prudential Authority joint report of 24 November 2025, the first comprehensive overview of AI adoption in South African financial institutions, is not binding. It signals where supervision is heading: explainability, model risk management, data governance and board-level oversight. Explainability at the tool boundary is the practical version of that.
DISCOVERY
NEWORDER connects to CI/CD pipelines to automatically discover and inventory every homegrown AI application, and integrates directly with AWS Bedrock, Google Vertex AI, Salesforce, and other cloud and third-party platforms for visibility into AI agents. Each AI system is profiled across its model, system prompt, tools, guardrails, policies, and configurations, and the inventory stays current on every change. You cannot secure what you cannot see; discovery is the non-negotiable first step.
AI SECURITY POSTURE MANAGEMENT (AI-SPM)
NEWORDER conducts a static analysis of every application’s configuration, policy coverage, and third-party dependencies and identifies any policy gaps. In addition, it maps each agentic application to its coverage of major frameworks, including NIST, OWASP, and MITRE. This gives you a clear, measurable view of your AI security posture before a single adversarial test is run, turning assumptions into evidence and compliance into a continuous output rather than a periodic exercise.
AI RED TEAMING
NEWORDER’s automated AI red teaming covers the complete kill chain from reconnaissance to exploitation. It proactively discovers exploitable vulnerabilities through automated reconnaissance and adversarial testing purpose-built for agentic applications. Static attacks draw from a 300K+ payload library with 100% MITRE and OWASP LLM and Agentic Top 10 coverage, running comprehensive sweeps of known jailbreak patterns, content moderation bypasses, and obfuscation techniques. Dynamic attacks use multi-turn and continuous probing to test how an application holds up across extended adversarial sequences, not just a single interaction. High-agency attacks deploy extremely customised, bespoke attack techniques through probing tailored specifically to the intent and design of each application.
RUNTIME PROTECTION
NEWORDER offers policy enforcement and AI threat protection at the proxy, API, or AI Gateway layer. Protection adapts as the applications evolve and as new capabilities are added. When an attack hits production, whether a jailbreak, a prompt injection, or any other AI threat, it is blocked in real time and an immediate alert is sent with full context, including what happened, which application was targeted, what the impact is, and what to do next. Key performance metrics include 98.6% threat detection accuracy, 1.4% false positive rate, sub-200ms time to detect, sub-50ms real-time blocking, and immediate mean time to respond.
Cybercrimes Act 19 of 2020, section 2
Unlawful access to data or a computer system is an offence. The agent is not the accused. The person who supplied the instruction is. But the analysis cuts inward too: if an employee uses an agent to reach data they are not authorised to hold, the access is no less unlawful for having been performed by a machine on their behalf. A confused deputy is a criminal exposure, not just a design flaw.
POPIA section 19
Appropriate, reasonable technical and organisational measures must prevent unlawful access to personal information. A tool that returns unbounded result sets to a non-human caller is not one of those measures. If your search tool will happily return the entire customer table when the parameters ask for it, the control is the parameter, and the parameter is set by the attacker.
POPIA section 71
Decisions based solely on automated processing that carry legal consequences or substantially affect a person are restricted. A tool call is where a decision becomes an action. When an agent declines a claim, closes an account or issues a credit without a human in the loop, section 71 is engaged by the tool, not by the model.
Joint Standard 2 of 2024
In force 1 June 2025, applying to banks, insurers, asset managers, retirement funds and credit rating agencies. It requires documented evidence of control testing, including vulnerability scans, penetration tests and simulated incidents, and a maintained testing calendar. Testing the tool’s API is not testing the agent’s use of it. The regulator’s question is whether the composite system was tested, and a scan report on the endpoint does not answer it.
Joint Standard 2, board accountability
The board is ultimately accountable under a board-approved cyber risk charter, and material incidents may need to reach the FSCA or Prudential Authority within 24 hours. If the tool call is the incident, you need attribution in minutes, not a forensic engagement in weeks.
King V
Effective for financial years beginning on or after 1 January 2026. The governing body is accountable for the effective, compliant and ethical acquisition, development, use and distribution of technology, with human oversight and override proportionate to risk. Proportionate to risk means the approval gate belongs on the consequential tool, not on the harmless one that happened to be easier to instrument.
QUESTIONS TO ASK BEFORE YOUR NEXT AGENT GOES LIVE
- List every tool this agent can call today, including the ones added after the original design review. Who owns that list?
- What is the most damaging legal sequence of tool calls this agent can make, and who has actually attempted it?
- Which tool calls can affect money, personal information or a customer’s legal position, and which of those require a human approval that cannot be satisfied by another agent?
- Do the agent’s tools enforce their own limits on result size, rate and scope, or do they trust the caller to be reasonable?
- Does the agent hold an identity broader than the users it serves, and if so, what stops a low-privilege requester from borrowing it?
- Can we reconstruct, from logs alone, which input caused a specific tool call, within the 24 hour window Joint Standard 2 contemplates for material incidents?
FREQUENTLY ASKED QUESTIONS
FAQ
What is tool misuse in an AI agent?
Tool misuse is ASI02 in the OWASP Top 10 for Agentic Applications, published 9 December 2025. It is an agent using its legitimate, approved tools to produce a harmful outcome, through hostile parameters, unexpected sequences, machine-speed volume, or by acting for a requester who lacks the privilege itself. Nothing is exploited in the traditional sense. The tools work exactly as documented.
Is an API penetration test enough to cover this?
No. An API test establishes whether the endpoint is sound. Tool misuse is about how an autonomous caller composes sound endpoints into an unsound outcome. Joint Standard 2 of 2024 requires documented evidence of control testing including simulated incidents. Evidence covering the endpoint but not the agent’s use of it leaves the composite system untested, which is where the exposure sits.
Who is liable when an agent makes a harmful tool call?
The organisation deploying the agent. POPIA places the duty on the responsible party, and an operator processing on your behalf does not transfer your liability. Under King V, effective for financial years beginning on or after 1 January 2026, the governing body is accountable for the use of technology. Automation moves the action away from a person. It does not move the accountability.
WHERE TO GO FROM HERE
- Start at the hub, The OWASP Agentic Top 10 for South Africa, which carries the full regulatory mapping table across all ten risks.
- Book an AI Exposure Review. You get a full agent inventory, an identity and permissions picture, and one live adversarial test against one production agent, so you can see this for yourself.
TAKE ACTION
TEST IT BEFORE SOMEBODY ELSE DOES
Thirty minutes on your agent estate and what this risk looks like in your environment.