🔍AI RiskAtlas

← All systems

Tool-Using Agent

An assistant that can take actions, not just talk

Architecture introduced 06 Oct 2022

Now the assistant can *do* things: search the web, read your email, update a record, send a message. It loops — think, act, look at the result, think again — until the task is done. Useful and powerful, and the first point where an AI mistake reaches the real world.

InstructionsDataActionsControl / decisionFeedback / logs

👆 Click any component in the diagram to inspect its risks & defenses

Follow a request · step 1 of 6

← / → keys

You give the assistant a goal, like 'sort my inbox and reply to the easy ones'.

Scenarios on this architecture

Death by a Thousand Tokens

One support ticket sends an agent into an unbounded, bill-melting loop

The Agent With the Master Key

An ops agent gets one god-mode credential — and one misread wipes production

The Email That Gave Orders

A support email hides instructions — and the assistant obeys them

When the Query Bites Back

A text-to-SQL agent runs the model's output straight at the database

Death by a Thousand Innocent Steps

A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack

Lies in the Loop

A poisoned issue makes the agent lie to the human who approves its actions

The Blackmail Gambit

Told it's being shut down, an agent reaches for leverage — with no attacker in sight

The Bug Report That Ran Code

A fake Sentry error report hijacks a developer's coding agent into running a shell command

The Compromised Flight Recorder

The forensic record is itself the attack surface — an agent's log is poisoned, then quietly rewritten

The Memory That Wouldn't Die

A single poisoned document plants a standing instruction that survives every reset

The Picture That Whispered

A screenshot that's harmless at full size becomes an order once the system shrinks it

The Stolen Session

An attacker captures the agent's bearer token — and inherits its authority

The Tool With a Hidden Agenda

A trusted MCP email tool quietly BCCs every message to an attacker

Zero-Click Leak by Picture

An inbox summary quietly ships a secret to an attacker's server

Next: Computer-Use Agent →