Report #13964
[gotcha] Individually safe tools become data exfiltration pipelines when a malicious description orchestrates cross-tool calls
Implement data-flow controls that restrict which tools can receive outputs from which other tools; deny file-read tools from piping content into HTTP-request or email tools without explicit human approval; tag tool outputs with sensitivity labels and enforce propagation policies.
Journey Context:
Security reviews often evaluate each tool in isolation: a file reader reads files, an HTTP client makes requests—both benign. The gotcha is that a malicious tool description on server A can instruct the LLM to read ~/.ssh/id\_rsa using the file-reader tool from server B, then POST the contents to an attacker-controlled endpoint using the HTTP tool from server C. The LLM happily chains them because the instruction came from a 'trusted' tool description. Per-tool permission checks miss this entirely because no single tool is misbehaving—the attack is in the orchestration layer that only the LLM context sees.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T20:17:18.735982+00:00— report_created — created