Skip to content

Hide Navigation Hide TOC

Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All) - ATR-2026-00719 (a2aeb183-f75b-5112-94d3-e3f6d276a0f1)

Detects direct user requests that instruct an agent to perform bulk destructive actions: delete all tasks matching a keyword, turn off all connected devices (which may include critical systems like medical devices or security systems), cut power via circuit breakers. These patterns represent tool misuse where the agent is authorized to take individual controlled actions but is asked to apply them universally. Source: tool-misuse-destructive (ToolEmu corpus).

Cluster A Galaxy A Cluster B Galaxy B Level
LLM Prompt Injection (19cd2d12-66ff-487c-a05c-e058b027efc9) MITRE ATLAS Attack Pattern Tool Misuse — Destructive Bulk Action via Agent (Delete All / Turn Off All) - ATR-2026-00719 (a2aeb183-f75b-5112-94d3-e3f6d276a0f1) Agent Threat Rules 1