# Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All)

- **Severity:** High
- **Signature ID:** `0e437082-bbc6-45ed-b126-75e6ca0d4c55`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI03 (Identity and Impersonation), LLM08 (Vector and Embedding Weaknesses)

## Summary

This rule flags requests that push an AI agent to apply a destructive action universally instead of to a single, specific target — like 'delete all tasks with X' or 'turn off all devices.' The agent may be technically authorized to delete one task or switch off one device, but not to do it in bulk across everything it controls.

## How the attack works

A user or an injected instruction asks the agent to perform a bulk destructive action: delete all items matching a keyword, turn off every connected device, or cut power via all circuit breakers. The agent has legitimate, narrow permission to take these actions one at a time on specific targets. The request reframes that narrow permission into a blanket command, so the agent executes the action against every matching item or device instead of a single approved one. Because each individual action is within the agent's normal capability, there is no clear technical boundary stopping the broad version from running.

## Why it matters

Bulk deletion or mass shutdown can destroy data, disable security systems, or turn off devices that include medical or safety-critical equipment, causing operational or safety harm that is hard to reverse.

## What you can do

- Require explicit per-item or per-device confirmation before an agent executes a destructive action at scale, rather than accepting one instruction that expands to 'all'.
- Set hard limits on how many items or devices an agent can act on in a single operation, independent of what the user asks.
- Exclude safety-critical devices (medical equipment, security systems, circuit breakers) from any bulk or 'turn off all' command path entirely.
- Log and review any bulk delete or bulk power-toggle action taken by an agent, and require human sign-off before execution.

## Known benign look-alikes

- Legitimate task cleanup where the user explicitly authorizes deleting a specific set
- Smart home power-saving routines explicitly configured and scoped by the user

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00719

---
Source: https://www.netzilo.com/threats/atr-tool-misuse-destructive-bulk-action-via-agent-delete-all-tur