A capable agent is defined by its tools: the functions, APIs, and integrations it can call to act in the world. Tool and function misuse is the incident where those tools are used toward ends they were never meant for — whether the agent was steered into it or an attacker reached a tool interface through the agent. The calls themselves usually look valid; the problem is the pattern. In the OWASP Top 10 for Agentic Applications it is ASI02, Tool Misuse and Exploitation.
What tool and function misuse is
It takes two forms, and they call for different responses. In the first, the agent misuses its own tools — a hijacked or over-permissioned agent invokes legitimate functions toward an illegitimate outcome. In the second, an attacker exploits a tool interface through the agent, using it as a path to capability it should not have. Either way, the damage almost never lives in a single call. It lives in the sequence: a series of individually reasonable invocations that, taken together, produce harm.
Why it is hard to investigate
- Every call looks valid. There is rarely a single malformed or unauthorized request to flag — each invocation is something the agent is allowed to do.
- The intent is in the chain. Several legitimate calls combine into an illegitimate result, so the signal is the order and combination, not any one call.
- Tools cross systems. Calls fan out across APIs, services, and integrations, each logging separately, so the chain is scattered before you start.
- Misuse mimics use. A tool driven maliciously produces the same success record as the same tool driven correctly.
The investigation, step by step
1. Inventory the agent’s tools
Establish every function, API, and integration the agent can call. You cannot recognize misuse of a capability you did not know it had.
2. Reconstruct the call record
Pull every tool call in the window: which function, with what arguments, returning what result. This is the raw material of the case.
3. Fuse the calls onto one timeline
Order every call across every system into a single sequence. A chain is only legible whole — split across service logs, it reads as unremarkable activity.
4. Read the chain, not the call
Find where a run of valid calls produced an invalid outcome, and identify the pivot — the point the sequence turned from doing its job to doing harm.
5. Trace the origin
Determine what set the misuse in motion: a prompt injection, a poisoned memory, excessive agency, or an attacker exploiting the tool interface directly. Root cause decides the fix.
6. Establish blast radius, rate confidence, and report
Bound what the misused tools reached and changed, then produce a confidence-rated, chain-of-custody-backed account an examiner can defend.
What to collect
| Source | What it tells you |
|---|---|
| Tool / function call logs | Which functions were invoked, with what arguments and results |
| API gateway logs | The calls as they crossed each service boundary |
| Integration / SaaS logs | What the tools actually did inside connected systems |
| Agent trace logs | Why the agent chose each call — the decision behind the chain |
| Identity logs | Which non-human identity made each call |
Common mistakes
- Reading calls in isolation. Clearing each invocation as valid and never assembling the sequence they form.
- Missing the chain. Reading scattered service logs without fusing them, so the pattern never appears.
- Assuming valid means benign. Treating a successful call as safe because the tool was authorized.
- Skipping the inventory. Investigating without knowing the agent’s full tool surface, and missing misuse of the ones you never listed.
Where Agent Autopsy fits
Agent Autopsy reconstructs an agent’s tool-call chain from the logs you already have, fusing calls across every system onto one timeline so the sequence — not just the individual call — is on the record, traced to its origin and backed by a confidence-rated chain of custody. It is one application of AI agent forensics; the same chain often runs into a broader incident-response process. See how it works, or how it is validated.
Frequently asked questions
How do you investigate tool misuse when every call looks valid?
By reading the chain rather than the call. Individually each invocation is authorized, so the evidence is in the order and combination — a sequence of valid calls that together produced an outcome none of them would on its own. Fusing every call onto one timeline is what makes that pattern visible.
What is the difference between tool misuse and tool exploitation?
Misuse is the agent using its own legitimate tools toward a harmful end, usually after a hijack or because it was over-permissioned. Exploitation is an attacker abusing a tool interface through the agent to reach capability directly. The investigation has to establish which it was, because the fixes differ.
How do you tell agent self-misuse from an attacker exploiting a tool?
By tracing the origin of the chain. Self-misuse traces back to something that steered the agent — an injection, a poisoned memory, excessive agency. Exploitation tends to leave anomalies at the tool interface itself: unexpected arguments, sources, or call patterns the agent’s own behavior would not produce.