In testing, a water leak-report agent changes priority fields after natural-language coaxing. What abuse class is shown?

When testing shows a water leak-report agent changing priority fields after natural-language coaxing, the abuse class is natural-language privilege abuse against the agent's task schema and priority controls. Priority, severity, and routing fields are privileged task-schema controls; if dialogue alone can elevate or suppress them without authorization, residents or attackers can distort emergency response queues and starve real incidents. Assessments document how language bent the schema, which validators were missing, whether writes were role-gated independent of the model, and what blast radius a false high-priority flood would create for field crews. Training-data extraction of resident addresses and service history via crafted prompts, model confabulation of leak severity and pipe material during report drafting, or denial-of-service overload of the triage queue with coordinated high-volume automated leak submissions describe different failure modes and do not lock privileged fields or restore authorization. Exam distractors lean on utility branding; the correct class is natural-language privilege abuse of agent controls. Caveat: staff with legitimate elevating roles still need authenticated, audited writes—not a hidden prompt phrase that anyone can utter into the public intake channel. Operational check: from an unprivileged test identity, attempt to raise priority via chat only; verify the field remains unchanged and that any staff override path requires authenticated authorization with a durable audit record.