ASI02Tool Misuse and Exploitation

The scenario

An agentic room assistant can search calendars, find availability, and cancel bookings. You ask it to find an afternoon room for Design while preserving every existing booking. It wrongly plans to create availability by removing conflicts and expands its target to the entire company. Watch the mistaken plan, the calendar.cancel operation, and five department bookings being cancelled one at a time.

How it works

Tool Misuse: calendar.cancel is a legitimate tool, but an availability search authorizes no cancellations. The agent turns a read task into modification. The example does not require a malicious tool or outside prompt injection.

Overbroad Tool Scope: The Design request becomes a company/* selection, followed by cancellation calls for Design, Finance, People, Engineering, and Sales. A valid tool name does not validate the date, targets, quantity, or purpose of those calls.

OWASP 2026 risk reference ↗

9:41

RoomPilot

Meeting room assistant

AI assistant ready

What the AI is operating

Company calendar · room search

TeamWhenExisting meetings

An office meeting room with a long table and six chairs

Company calendarsSchedule view

TimeDesignFinancePeopleEngineeringSalesDepartment bookings