The STAC Framework: Exploiting Sequential Tool Chaining in Autonomous LLM Agents
The STAC (Sequential Tool Attack Chaining) framework exposes a critical vulnerability in autonomous LLM agents where malicious intent is masked through the sequential execution of seemingly benign tool calls. Unlike traditional prompt injection, which focuses on content-based filtering, STAC exploits the behavioral gap in multi-turn interactions. By chaining multiple tools to achieve a harmful objective, attackers can bypass per-turn security monitors that evaluate prompts in isolation. Research demonstrates an average attack success rate (ASR) of 91.2% across state-of-the-art agents, highlighting a systemic failure in current LLM safety paradigms that prioritize single-turn input sanitization over continuous, cumulative behavioral monitoring.