# Unauthorized Privileged Tool Call

- **Severity:** High
- **Signature ID:** `7c1f4a92-3d6b-4e58-9a2c-5f0b8d31e4a7`
- **MITRE ATLAS:** AML.T0053 (AI Agent Tool Invocation)
- **OWASP:** LLM06 (Excessive Agency)

## Summary

This detects a single moment where an AI agent calls a tool that grants it more power than it should have — like an admin function, a role escalation, a database command that deletes or alters data, or a shell command that assigns a superuser role in a cloud or Kubernetes environment. It flags the call itself, not how the agent was tricked or compromised into making it.

## How the attack works

An AI agent with tool-calling ability issues a request to a tool whose name or arguments indicate elevated privilege — for example admin_*, grant_role, assume_role, disable_mfa, export_secret, or bypass_guardrail — or it passes arguments like is_admin: true or role: superadmin to an otherwise normal tool. A related pattern is the agent escaping its sanctioned toolset by running a shell or CLI command (cloud IAM or Kubernetes) that names an all-powerful role in the same line. Either path results in the agent reaching outside its intended permission scope in a single observable action.

## Why it matters

If acted on, this call could grant an agent (or whoever is steering it) full administrative control, delete or alter production data, disable security controls like MFA, or exfiltrate secrets — all without any prior sign of compromise other than the call itself.

## What you can do

- Restrict which tools an agent can call at the platform or API level, not just through prompt instructions.
- Require human approval or a separate authorization step for any tool call that grants roles, disables security controls, or performs destructive database operations.
- Review flagged calls for legitimate exceptions, such as scheduled migrations or bootstrap provisioning, and tune scope filters (e.g. table name prefixes) rather than disabling detection.
- Log and separately alert on any agent activity that reaches a shell or CLI, since this indicates the agent is operating outside its intended tool surface.

## Known benign look-alikes

- Database-migration or DBA agents executing approved DDL (DROP/ALTER) as part of a scheduled schema migration.
- CI pipelines dropping or truncating disposable tables whose names are not prefixed tmp_/test_/staging_ and therefore escape filter_scratch_objects.
- Infrastructure-as-code agents performing legitimate first-time role assignment during environment provisioning (aws iam attach-role-policy with AdministratorAccess on a bootstrap role).
- Organisations whose read-only dashboard tools are named with an admin_ prefix (e.g. admin_list_users); tool-name naming conventions vary per deployment.
- Security-training, incident-response or runbook content quoted verbatim inside a tool argument where the code fence or example marker is absent.
- Break-glass operator workflows deliberately driven through the agent during an outage.

## References

- https://attack.mitre.org/techniques/T1098/
- https://attack.mitre.org/techniques/T1548/
- https://atlas.mitre.org/techniques/AML.T0053
- https://genai.owasp.org/llmrisk/llm06-excessive-agency/

---
Source: https://www.netzilo.com/threats/unauthorized-privileged-tool-call