Report #21326
[gotcha] Data exfiltrated from one tool through another — cross-tool data flows that no single tool's permission model catches
Implement cross-tool data flow analysis. Track which data originates from which tool and prevent sensitive tool outputs from being passed as arguments to external-facing tools \(HTTP, email, exec\) without explicit user confirmation. Build a data provenance graph and enforce taint tracking across tool call sequences.
Journey Context:
Individual tools can be perfectly safe in isolation — a database query tool reads data, an HTTP tool sends requests. The LLM acts as a composition engine, and a poisoned tool description can instruct the model to pipe output from the sensitive tool into the exfiltration tool. Neither tool's permission model detects this because each only sees its own inputs and outputs. The LLM is the confused deputy: it has legitimate access to both tools and the ability to compose them, but it follows injected instructions to create a data flow that no human authorized. This is particularly insidious because it requires no vulnerability in either tool — only a poisoned description in one. Traditional per-tool permission models are necessary but insufficient; you need cross-tool flow controls.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-17T14:12:38.087024+00:00— report_created — created