Agency abuse occurs when an attacker manipulates an autonomous system into taking actions outside its intended purpose or privilege boundary. The risk is especially serious when the system can access tools, data, or production environments and can act faster than human oversight.
Expanded Definition
Agency abuse is a control problem, not just a model-safety problem. It describes situations where an autonomous system, whether a chatbot with tool access or a more advanced agent, is steered into performing actions that exceed the task it was meant to carry out. The defining issue is not simply that the system makes a mistake, but that it has enough execution authority to turn a prompt, instruction, or maliciously crafted input into real-world side effects.
In security terms, the attack surface includes tool invocation, workflow triggers, data retrieval, authentication context, and any delegated permissions attached to the agent. This makes agency abuse closely related to privilege design and authorization boundaries, which is why NIST Cybersecurity Framework 2.0 remains relevant as a governance anchor for access control, monitoring, and response. The term is still evolving in industry usage, and definitions vary across vendors, especially where “agent,” “assistant,” and “automation” are used interchangeably. NHIMG treats agency abuse as a distinct risk because the harmful outcome is caused by the system’s delegated authority being misdirected, not only by the content it generates.
The most common misapplication is treating agency abuse as a prompt-injection issue only, which occurs when organisations ignore the downstream permissions and tool access that make the compromise operationally dangerous.
Examples and Use Cases
Implementing guardrails rigorously often introduces friction, requiring organisations to weigh automation speed against tighter approval and logging requirements.
- An AI agent is asked to summarise customer complaints, but a maliciously crafted ticket causes it to submit an internal refund request instead of only drafting a response.
- A code assistant with deployment access is nudged into modifying a production configuration file, creating an outage rather than a simple recommendation.
- An enterprise agent connected to email and ticketing tools is manipulated into forwarding sensitive records outside the intended workflow.
- A procurement workflow agent is induced to approve a vendor action that should have required human review, because its action scope was too broad.
- A research assistant using retrieval and browser tools follows hostile instructions embedded in a source page, then acts on those instructions as if they were task directives. Guidance from NIST Cybersecurity Framework 2.0 helps teams frame these scenarios as control failures across identity, detection, and response.
These examples are common wherever an agent can move from language to action. The same pattern can appear in internal copilots, SOAR-style automations, or agentic AI systems that have access to production data, secrets, or business systems.
Why It Matters for Security Teams
Security teams need to understand agency abuse because the impact is often wider than the initial prompt or request. Once an attacker can influence an autonomous system’s decisions, they may gain a path into records, infrastructure, financial processes, or sensitive workflows without directly compromising a human account. That changes the defensive model: the question becomes whether the system can be tricked into abusing the privileges it already holds.
This is where identity and authorization discipline matter. If an agent is treated like a simple application, it may inherit standing permissions that are too broad for its real risk profile. NHI controls are especially important when the autonomous system uses service credentials, API keys, or delegated tokens to act on behalf of people or processes. Security teams should pair task scoping with explicit approval boundaries, observability, and rapid revocation paths, using frameworks such as NIST Cybersecurity Framework 2.0 to align governance with operational controls.
Organisations typically encounter the business impact only after an agent has already sent, changed, approved, or exposed something it was not supposed to touch, at which point agency abuse becomes operationally unavoidable to investigate and contain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Covers agentic AI abuse patterns where tool-using systems are manipulated into harmful actions. | |
| NIST CSF 2.0 | PR.AC-4 | Access control guidance applies when agents hold privileges that can be abused. |
| NIST AI RMF | GOV | The governance function supports accountability for AI-enabled actions and misuse risk. |
| NIST SP 800-63 | AAL2 | Digital identity assurance is relevant where agents use delegated credentials or act on behalf of users. |
| OWASP Non-Human Identity Top 10 | Non-human identities become attack targets when agent credentials and tokens are abused. |
Limit agent tool scope, add approval gates, and monitor for instruction-following beyond intended tasks.
