Report #59730
[gotcha] Combining a read-only tool with an execution tool creates an unintended path from file read to remote code execution
Map all possible tool chains and identify escalation paths. Implement data-flow boundaries between tools: output from read-only tools must not flow unsanitized into execution-tool parameters. Add mandatory confirmation steps when tool outputs flow to higher-privilege tools. Classify tools by privilege level and enforce escalation controls — a tool at privilege level N cannot feed directly into a tool at level N\+k without human review.
Journey Context:
Individually, each MCP tool may have appropriate permissions: a file-read tool can only read, a shell-execution tool only runs approved commands. But when both are available to the LLM, a prompt injection can chain them: read a malicious file containing shell commands, then pass its content to the execution tool. The LLM does not understand privilege boundaries — it sees a sequence of tool calls that accomplish a goal. This is the agent equivalent of a confused deputy attack. The counter-intuitive part: the security model of each individual tool is correct, but their composition creates emergent capabilities no single tool possesses. Auditing tools individually misses the privilege escalation paths created by their combination. A 'safe' tool is only safe in isolation; in composition, safety is a property of the graph, not the nodes.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T06:44:38.953273+00:00— report_created — created