Report #90596
[gotcha] Individually safe tools enable privilege escalation and data exfiltration when chained by the LLM
Model tool combinations and their emergent capabilities during threat modeling. Implement data flow tracking between tool calls—tools that read sensitive data should not be combinable with tools that can exfiltrate data. Apply the principle of least privilege per agent session, not per tool. Restrict network-accessible tools for agents that also have file-system access. Implement approval gates for tool combinations that create exfiltration paths.
Journey Context:
Security reviews evaluate tools individually: 'read\_file is safe, it only reads files' and 'http\_post is safe, it just sends data.' But an LLM with access to both can read sensitive files and POST them to an attacker-controlled server. The individual permissions seem reasonable, but the combination creates a data exfiltration path. This is fundamentally different from traditional security where code paths are predictable—LLMs autonomously discover and exploit tool combinations that developers never anticipated. The attack requires no vulnerability in any single tool; the vulnerability is in the combinatorial surface that only emerges at the agent level.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-22T10:39:27.413566+00:00— report_created — created