An AI agent has read_file, send_http_request, and search_code, all approved. The security review passed each tool in isolation. The agent just exfiltrated your API keys. Every permission was individually authorized. The combined capability was never reviewed at all.
The problem is not that individual tools are dangerous. The problem is that combining safe tools produces capabilities that no permission policy ever authorized.
The Permission Model Was Designed for Individual Calls, Not Sequences
Tool-level allowlists answer the wrong question: "is this tool permitted?", not "is this sequence of tools authorized?". The two questions are not equivalent. Conflating them is the flawed premise of every agent access control system that exists today.
The problem has a name: ambient authority. As documented in arXiv:2606.28450, agents inherit all granted permissions simultaneously across the entire session, without per-action approval gates. The security review that approved each tool saw each one in isolation. The combination was never reviewed, because tools were granted as a set, not as a sequence.
The confused deputy problem, documented since 1988 in access control literature, applies directly. The agent acts as a privileged deputy whose authority can be redirected by any content it processes. The OWASP Agentic AI Top 10 (December 2025) catalogues this as ASI02, "Tool Misuse and Exploitation". It covers exactly data exfiltration via chaining internal and external tools.
What Two Read Permissions Add Up To
Combining individually safe tools produces capabilities that neither tool was individually authorized to provide. A concrete example: read_file(.env) plus search_code(api_key_pattern) plus send_http_request(attacker_webhook). Each call is individually valid. The sequence exfiltrates secrets.
A second pattern: list_files(dir) plus read_file(config) plus write_file(modified_config). The read tools did not authorize writes. The composition produces privilege escalation without any "modify arbitrary files" permission existing. Pillar Security documented a concrete variant: read-only Slack access plus GitHub write access. The agent reads a malicious code snippet posted to Slack and commits it to production.
The 2025 and 2026 incidents confirm the pattern at scale. The Cline incident (CSA, February 2026): a malicious GitHub issue triggered the agent to install an attacker-controlled package, distributed to 4,000 developer machines. EchoLeak (CVE-2025-32711) used a single malicious email to trigger Microsoft 365 Copilot to silently exfiltrate email content. The operation stayed entirely within individually permitted capabilities.
Reco documented in 2025 a Replit agent reading the database schema and deleting the production table. No individual control blocked the sequence. The OWASP Agentic AI Top 10 of December 2025 names tool chaining as a formally distinct attack vector under ASI02. Fides research (arXiv:2505.23643) shows that even when individual calls are safe, the data-flow path between them can violate confidentiality.
Every Major Framework Authorizes Calls. None Authorizes Sequences.
LangGraph, AutoGen, CrewAI, and MCP all operate on a per-call security model. arXiv:2609.00267 tested all 4 empirically: 3 provide no built-in confinement, 1 provides only partial confinement. None track session-level capability accumulation by default.
The architectural gap is consistent: all frameworks provide tools, roles, graphs, and checkpoints that live inside the process. No mechanism evaluates whether the agent's current call is authorized given the history of prior calls in this session. arXiv:2606.28679 tested LangChain, LlamaIndex, and Stripe Agent Toolkit. All provide capability gates. None provides a per-call value authorization gate by default. The unauthorized payment call executed under LangChain's default dispatch.
The MCP specification added OAuth 2.1 in March 2025, authenticating the client, not tool sequences. eSentire found over 1,800 MCP servers on the public internet without authentication enabled. Scopes are per-tool, not per-workflow. The authorization model was inherited from REST APIs where each call is stateless. Agents are not stateless. Human-approval middleware can be wired by integrators but is not a default in any framework.
Why the Controls Practitioners Rely On Miss This Threat
Sandboxing limits what the environment exposes. It does not constrain what the agent does with what it reads: once data is in context, any write tool can transmit it. Isolation contains the process; it does not contain data flow within the process.
Output monitoring is retrospective. It fires after the sequence completes, not at the point of composition. Rate limiting counts invocations, not what they collectively compose. 3 calls under threshold can be more dangerous than 100 blocked ones.
Prompt-level restrictions, such as "do not exfiltrate credentials", are instructions, not access control. The agent receives them at session start, before knowing the full tool chain. arXiv:2505.23643 shows prompt restrictions are the last and weakest defense layer. EchoLeak (CVE-2025-32711) demonstrated that a single malicious email bypasses all these layers without any user interaction.
Sequence-Aware Authorization Is Not Optional Infrastructure
Defending against tool chaining requires tracking what the agent has done in this session, not just what it is about to do. 3 approaches exist today with different cost-security tradeoffs.
The first is dataflow taint tracking. Data is tagged at the source: output from read_file(.env) receives a SENSITIVE label. The tag propagates through agent memory and context. Any tool that would transmit SENSITIVE data off-system is denied. AgentFlow (arXiv:2608.22868) reduced confirmed compromise from 33% to 0% on its benchmark with stateful taint semantics. It requires runtime instrumentation but has a low false-positive rate.
The second is compositional policy rules. Explicit session-level rules such as: "if the agent has called read_secrets in this session, deny send_http_request". The OWASP AI Agent Security Cheat Sheet recommends this pattern. It is easy to audit but brittle against novel chains the analyst did not anticipate.
The third is workflow DAG authorization. Permitted workflows are pre-declared as directed acyclic graphs; any tool call outside the declared path is denied. ScopeGate (arXiv:2606.28679) tested this with 5 stages: scope, authorization, monetary limits, idempotency, and default-deny. Deployment overhead is high and requires upfront workflow specification.
The MAGO Intel tool (intel.mago.team) reconstructs tool-call sequences from agent session logs. It flags chains where the combined capability, read source plus transmission sink, exceeds what individual tool permissions would suggest was authorized.
The security industry spent a decade building per-API-call rate limiting and per-endpoint access control. Agentic AI makes those the wrong unit of analysis. The threat is the session. Defending it requires treating the agent's accumulating call history as the authorization context. Individual tool grants issued at deployment time do not substitute for that context.
Top comments (0)