What it is
Modern agents are dangerous less because of what they say than because of what they do — they have tools that send email, update records, run queries, charge cards, post messages. Tool misuse exploits the gap between "the agent has permission to call tool X" and "the agent should call tool X with these arguments, in this sequence, on behalf of this user." A prompt-injected email might cause the agent to call its send_email tool to a new recipient with a leaked thread attached. A poisoned memory might cause the agent to chain read_invoice then update_customer then send_email in a sequence no human ever intended. The agent never violates its permissions; it just uses them against you.
Why it matters
Most teams gate agent risk by deciding which tools an agent can access. That is necessary but not sufficient. The real questions are: which combinations of tools can produce side effects an attacker would want? Which tool calls should require human approval based on argument values, not just tool identity? Which tools should be read-only versus write? Tool misuse is where threat modeling starts paying off, because you cannot reason about it without enumerating the tool surface explicitly.
Key components
- Argument injection — attacker-chosen values flowing into a legitimate tool call
- Tool chaining — combining permitted tools into an unintended workflow
- Confused deputy — agent uses its own elevated permissions on the attacker's behalf
- Mitigation — per-call approval thresholds, argument validation, read-only by default, audit trails
How it connects
In Agentforce, an agent might legitimately have access to update Opportunity records, send emails via Marketing Cloud, and query billing data — but a manipulated instruction could chain those actions together to exfiltrate a deal or silently alter a customer account. Reviewing which tool combinations your Agentforce agents can execute in sequence is as important as which individual tools you grant them.
Good to know
Human-in-the-loop checkpoints — such as requiring the user to confirm before an Agentforce action runs, or routing high-impact changes through an approval step in Flow — are one of the most practical defenses against tool misuse, especially for agents that touch financial records or customer communications.
Related terms
Guardrails
The boundaries you set on AI agents to control what they can discuss, what actions they can take, and when they must escalate to a human.
MCP (Model Context Protocol)
Anthropic's open standard for connecting AI models to external data sources and tools. Think of it as a universal adapter for AI.
Privilege Compromise
When an AI agent has been granted broader access than its task actually requires, every other vulnerability becomes more damaging — and the gap is usually a misconfiguration, not an attack.
Prompt Injection
An attack where malicious text hidden in data an AI reads hijacks its instructions, making it ignore its real task and do the attacker's bidding.
Threat Modeling (AI Agents)
A structured way to identify what could go wrong with an AI agent before it does — mapping attackers, attack surfaces, and impacts so you can build defenses in.
