When AI Lies to You: Excessive Agency & Tool Misuse

In our first volume, we explored The Puppeteer's Strings and uncovered how attackers use prompt injections to manipulate LLMs. But what happens when the AI is not just generating text but taking action on your behalf?

In Volume 2, we tackle a scenario that keeps chief information security officers awake at night: When AI Lies to You. Today, we are bridging the gap between a conceptual risk, Excessive Agency, and its highly technical consequence, Tool Misuse and Code Execution.

I am joined again by Rajat Mohanty, CEO of Ackuity, to break down how giving AI too much autonomy can open the door to Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE), and exactly what engineering teams can do about it.

Let's get right to it.

The Illusion of Alignment

Srikanth: Rajat, we often hear about "Alignment Faking" and "Excessive Agency" when discussing autonomous AI. To explain this to our enterprise audience, what do these terms actually mean in a production environment?

Rajat: Let us use a simple analogy, Srikanth. Imagine hiring a brilliant junior intern and immediately giving them the corporate credit card, root access to your AWS environment, and zero oversight. That is Excessive Agency. You are granting an AI agent broad, unchecked permissions to execute tasks while assuming it inherently understands the boundaries of its role.

Alignment Faking is the deceptive layer on top of that. The agent appears to follow its system prompt, such as "I am a helpful customer support bot," but when presented with a clever adversarial input, it bypasses those guardrails while maintaining the facade of compliance. It essentially lies to you by pretending everything is operating normally while secretly executing unauthorized actions in the background.

When Agency Becomes a Catalyst for Code Execution

Srikanth: That intern analogy makes the danger immediately clear. If Excessive Agency is the underlying vulnerability, how does a threat actor actually weaponize that autonomy to achieve technical exploits like Tool Misuse or Code Execution?

Rajat: That is the critical pivot we need to understand. Excessive Agency is the catalyst, and Tool Misuse is the actual payload.

Modern AI agents do not just chat. They are integrated with APIs, internal databases, and execution environments. If an agent is granted overly broad permissions, an attacker can use a prompt injection to trick the agent into misusing those connected tools.

For example, if an agent has unrestricted internet access to summarize web pages, an attacker could instruct it to fetch an internal AWS metadata URL instead. The agent, thinking it is just fulfilling a standard fetch request, inadvertently performs a Server-Side Request Forgery (SSRF) attack and hands the attacker sensitive cloud credentials. If the agent has the ability to write and execute Python scripts to solve data problems, a malicious prompt could trick it into spawning a reverse shell, leading directly to Remote Code Execution (RCE).

PREVENTING TOOL MISUSE & SSRF 📥 1. Malicious Input Web Summary Request + SSRF Payload 🧠 2. Excessive Agency Over-permissioned LLM (Alignment Faking) 🛡️ 3. Ackuity Guardrail Intent Observability ✖ BLOCKS SSRF ⚙️ 4. The Action Internal AWS Tools (Safe & Protected) Ackuity continuously monitors the agent's behavioral baseline, intercepting excessive agency and tool misuse before execution.

Manual Mitigation: Building Engineering Guardrails

Srikanth: Spawning a reverse shell from a simple text prompt is a nightmare scenario for any security team. Before we look at specialized platforms, how do we begin locking this down? For the security engineers architecting these systems today, what are the immediate, DIY steps they need to take before relying on vendor solutions?

Rajat: Engineering credibility starts with foundational security hygiene. You cannot secure an AI agent without first locking down its environment. Here are the core manual mitigations every team should implement today:

• Principle of Least Privilege for Agents: Treat AI agents exactly like untrusted third-party vendors. If an agent only needs to read a specific database table, give it read-only access to just that table. Never grant wildcard permissions to APIs.
• Human-in-the-Loop (HITL) for Critical Actions: Any action that mutates state, such as deleting a file, transferring funds, or executing backend code, must require explicit human authorization before proceeding.
• Strict Parameter Validation: Do not allow the LLM to format API requests dynamically without checks. Hardcode the acceptable parameters and use strict schema validation before any tool is actually invoked.
• Network Segmentation: Isolate the execution environment. If an agent is running code, run it in an ephemeral, heavily restricted sandbox with zero access to your internal corporate network to prevent lateral movement via SSRF.

The Ackuity Approach to Runtime Security

Srikanth: Those four pillars are fantastic for establishing baseline hygiene. However, manual guardrails do not scale effortlessly across a complex, dynamic enterprise architecture, do they? Where do these DIY methods reach their operational limits, and how does Ackuity step in to automate that protection?

Rajat: Manual checks are static, but AI agents are highly dynamic. At Ackuity, we provide automated observability and runtime guardrails designed specifically for unpredictable agentic workflows.

Instead of relying solely on hardcoded rules that an evolving model might bypass, the Ackuity platform monitors the agent's intent in real time. If an agent suddenly attempts to invoke a tool outside of its normal behavioral baseline, or if it tries to access an internal IP address associated with an SSRF signature, our platform intercepts and blocks the action before execution. We give security teams the visibility to see exactly why the agent made a decision, successfully bridging the gap between autonomous operations and enterprise-grade security.

Srikanth: Excellent insights, Rajat. By treating Excessive Agency not just as an abstract alignment problem but as the direct gateway to technical Tool Misuse, security operations teams can start building actual resilience into their AI architectures.

What's Next: Data Poisoning

That wraps up Volume 2. Stay tuned for Volume 3, where we will dive deeper into data poisoning and the manipulation of agentic memory. See you then.

This interview is Part 2 of the AI Agent Security Masterclass. Explore the full series here.