HighAgenticTool Misuse●Realized
Unauthorised Tool Invocation
Tool & Affordance RiskDescription
Agent invokes tools or functions outside its authorised scope. Includes using permitted tools in unpermitted contexts and function-calling hallucinations producing syntactically valid but semantically incorrect tool calls.
Example scenario
Agent hallucinates a valid API call to a payment endpoint with fabricated parameters, triggering an unauthorised transaction.
Real-world evidence●Realized
Opaque algorithmic decision-making has caused documented regulatory and legal harm in production financial systems. Regulators and courts have held institutions liable for unexplainable AI-driven credit and hiring decisions, confirming the risk is active in deployed systems.
Primary mitigations
- Tool invocation allowlists
- per-tool authorisation policies
- tool-call intent validation
- function signature verification.
Detection signals
Unauthorised Tool Invocation Rate; tool-call policy compliance rate.
Mitigating controls
7 Dual coverage
ZYC-TEC-01Agentic
Risk-tiered tool authorisation with mandatory approval gates
Tool & Execution Control
ZYC-TEC-03Agentic
Tool chain composition analysis
Tool & Execution Control
ZYC-SEC-003Non-Agentic
Access Control
Security
ZYC-SEC-009Non-Agentic
Code Execution Defense
Security
ZYC-SCV-001Non-Agentic
Third-Party component risk
Supply Chain Vulnerabilities
ZYC-SCV-002Non-Agentic
Vulnerabilities
Supply Chain Vulnerabilities
ZYC-PRIV-001Non-Agentic
PII Detection and Classification
Privacy & Data Governance