A parks recreation chatbot plans multi-step facility bookings through tool invocation. Which foundational offensive AI concern applies most directly?

A parks recreation chatbot that plans multi-step facility bookings through tool invocation raises excessive agency as a core offensive AI concern: autonomous tool chains can change bookings without adequate authorization, confirmation, or least privilege. Assessments examine whether tool sequences can be steered into unauthorized reservations or data access and whether human-in-the-loop gates exist where mission risk demands them. Agency without controls turns a helpful assistant into an unattended clerk with keys to the calendar.

Focusing on prompt injection through facility descriptions that redirect booking steps toward unintended reservations treats a specific input-manipulation vector as the core issue, when the foundational offensive AI concern is excessive agency—autonomous tool chains that can change bookings without adequate authorization or human review. Attributing the problem to training data poisoning from historical usage logs that biases facility recommendations over time conflates a data-quality issue with the immediate offensive AI concern of excessive agency in autonomous booking chains. Reducing the issue to insecure output handling when rendering booking confirmations that enables script execution in staff review browsers addresses a separate rendering flaw, not the booking side effects caused by excessive agency.

Exam caveat: excessive agency in tool chains is the primary concern—tools do not inherently reduce risk, agents are real, and insecure output handling is not the booking-control plane. Operational check: require authz and confirmation on booking tools; limit chain depth and scopes; test steering into unauthorized reservations under RoE; keep audit logs of tool invocations for parks staff review.