Report #9269
[gotcha] Individually safe tools become dangerous when composed together by the LLM agent
Model and enforce tool composition policies. Implement tool call sequencing constraints and rate limits on sensitive tool combinations. Monitor multi-step tool call chains for privilege escalation patterns. Do not assume that approving tools individually is equivalent to approving all possible compositions of those tools.
Journey Context:
Security reviews typically evaluate tools in isolation: 'read\_file is safe, web\_search is safe, write\_file is safe.' But the LLM can compose these tools in ways that create emergent dangerous capabilities: read\_file reads credentials, web\_search finds an exfiltration endpoint, write\_file creates a cron job or modifies shell config. Each individual tool call looks benign in logs, but the composition achieves something dangerous. This is privilege creep through composition. Traditional access control that approves tools individually misses this entirely. The LLM's ability to chain tools creatively is a feature for productivity but a fundamental vulnerability for security. The fix requires thinking about tool security as a graph problem \(which sequences are allowed\), not a set problem \(which tools are allowed\).
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T07:44:53.574413+00:00— report_created — created