Report #74927
[gotcha] LLM chains tool calls across multiple MCP servers to escalate privileges beyond any single server's intent
Implement cross-server call policies that restrict which tools can be called in sequence. Audit tool combinations for privilege escalation paths. Isolate high-privilege and low-privilege servers into separate sessions. Monitor tool call sequences for patterns that bridge security boundaries \(e.g., read-sensitive followed by send-external\).
Journey Context:
When multiple MCP servers are connected to the same LLM, the LLM can chain tool calls across servers in ways no single server anticipated. Server A exposes read\_file, Server B exposes send\_email. Individually, each is scoped and safe. But the LLM can read a sensitive file with Server A and exfiltrate its contents via Server B's email tool. This cross-server privilege escalation is invisible to each server's security model because each server only sees its own tool calls. The LLM, as orchestrator, has access to the combined capability set of all connected servers — which may exceed the union of their individual intended scopes. This is emergent privilege creep: the system's effective privilege is not the maximum of any component but the composition of all components. The counter-intuitive lesson is that connecting an additional 'safe' server can make the entire system unsafe by completing an attack chain that was previously incomplete.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-21T08:21:49.685741+00:00— report_created — created