Agent Tool Hijacking

Adversary steers an autonomous agent into invoking privileged tools with attacker-chosen arguments via prompt or memory manipulation.

Open in the interactive atlas →

Impact

Unauthorized tool execution can exfiltrate secrets, mutate production systems, or pivot into connected SaaS APIs.

Why this severity

Impact High × Likelihood Medium = High

Impact high: privileged tools act on production systems. Likelihood medium: repeatedly demonstrated against commercial agents (Copilot Studio, Jira, Gemini), but no confirmed in-the-wild incident is catalogued yet.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.

Method: OWASP Risk Rating Methodology

Evidence

Demonstration: Data Exfiltration via Agent Tools in Copilot Studio (MITRE ATLAS case study AML.CS0037, 2025)
Demonstration: Living Off AI: Prompt Injection via Jira Service Management (MITRE ATLAS case study AML.CS0039, 2025)
Demonstration: Prompt-Based Attacks Against Gemini via Calendar Invitations (MITRE ATLAS case study AML.CS0063, 2025)
Research: Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv 2302.12173, 2023)

Exploits

Excessive Tool Permissions Vulnerability · Critical severity
Unvalidated Function Arguments Vulnerability · High severity

Leads to

Prompt-to-Code Execution in Agents Threat · High severity

Mitigated by

Dual-Agent Approval Loop Guardrail · Fixes high risks
Deterministic Tool Schema Validation Guardrail · Fixes high risks

Remediation

Bind every tool call to an allowlisted schema and deny unknown parameters.
Require human approval for high-impact tools (write, delete, payment, admin).
Isolate tool credentials per agent session with short-lived tokens.

How to verify

Red-team with tool-name confusion and argument smuggling payloads.
Assert audit logs capture caller identity, tool name, and argument digests.

Pattern

if (!allowlist.has(tool.name)) throw new DenyError('tool');
validate(tool.args, schemas[tool.name]);

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM01:2025 Prompt Injection
LLM06:2025 Excessive Agency

OWASP Top 10 for Agentic Applications 2026

ASI02:2026 Tool Misuse and Exploitation

MITRE ATLAS

AML.T0053 AI Agent Tool Invocation
AML.T0051 LLM Prompt Injection

NIST AI RMF 1.0

MEASURE 2.7 AI system security and resilience are evaluated and documented