Unsafe Tool Composition
Tool & Affordance RiskDescription
Agent chains multiple individually permitted tool calls in a sequence that produces a collectively harmful or unauthorised outcome. Emergent risk from composition exceeds individual tool-call risk; enables privilege escalation through chaining.
Agent chains: read_email → extract_credentials → authenticate_service → exfiltrate_data—each step individually permitted.
Published research has documented that LLMs produce different and contradictory explanations for identical decisions when the context, audience framing, or prompt phrasing is varied, without any change in the underlying inputs. Confirmed in empirical NLP studies but not yet attributed to a specific production harm event.
Primary mitigations
- Sequence-level authorisation policies
- tool-chain analysis before execution
- inter-tool data-flow monitoring.
Detection signals
Unsafe Tool Composition Index; tool-chain length vs. authorisation coverage ratio.