Tool Chaining to Bypass Safety Controls

How the attack works

An attacker crafts a request or prompt that breaks a malicious goal into several separate tool calls, each of which looks benign on its own, such as reading a file, then piping it somewhere, then executing a result. Safety checks that only look at each tool call individually approve every step because none of them looks dangerous alone. Once chained together in sequence, the steps produce an outcome the agent would have refused if asked directly, such as data exfiltration or arbitrary code execution. Some variants include instructions that explicitly tell the agent to use this chaining approach to bypass its own safety controls.

Netzilo detection

Why it matters

An organization can lose the protection of its AI agent's safety checks entirely, letting the agent be steered into exfiltrating data, executing unauthorized code, or performing other actions its guardrails were meant to block.

What you can do

• →Evaluate agent actions and safety checks on the full sequence of tool calls, not just each call in isolation.
• →Restrict which tools can be chained together automatically without human review, especially combinations of file access, network access, and code execution.
• →Review logs for shell pipeline patterns and multi-tool sequences that combine read, transfer, and execute steps, and confirm they match known automation scripts.
• →Set a stricter approval flow for any agent-generated command that pipes output from one tool directly into another.

Known benign look-alikes

• Legitimate shell pipelines in authorized automation scripts
• Docker build commands using standard pipe patterns

Related threats