The STAC (Sequential Tool Attack Chaining) framework exposes a critical vulnerability in autonomous LLM agents where malicious intent is masked through the sequential execution of seemingly benign tool calls. Unlike traditional prompt injection, which focuses on content-based filtering, STAC exploits the behavioral gap in multi-turn interactions. By chaining multiple tools to achieve a harmful objective, attackers can bypass per-turn security monitors that evaluate prompts in isolation. Research demonstrates an average attack success rate (ASR) of 91.2% across state-of-the-art agents, highlighting a systemic failure in current LLM safety paradigms that prioritize single-turn input sanitization over continuous, cumulative behavioral monitoring.

• Threat Model/Vulnerability Overview: The Behavioral Safety Gap
  • Transition from content-based safety (keyword/prohibited word filtering) to behavioral safety (monitoring tool-use sequences).
  • Identification of a "blind spot" in existing defenses that evaluate individual prompts or responses on a per-turn basis.
  • Vulnerability arises when agents pursue defined objectives through unforeseen, potentially harmful tool-use paths that appear innocuous in isolation.
• Attack Mechanics: The STAC Pipeline
  • Employs an automated, closed-loop system to synthesize and validate executable tool chains within a live environment.
  • Utilizes reverse-engineering to develop stealthy prompts designed to trigger specific multi-step tool sequences.
  • Capable of chaining up to five distinct vulnerabilities into a single, continuous autonomous attack.
• Systemic & Security Impact: High Exploitation Efficacy
  • Demonstrated an average attack success rate (ASR) of 91.2% against evaluated models.
  • Achieved >90% ASR for 7 out of 8 evaluated state-of-the-art (SOTA) agents.
  • Validated via the STAC Case Dataset, encompassing 483 attack cases and 1,352 unique user-agent-environment interactions.
• Countermeasures & Defense: Efficacy and Erosion
  • Reasoning-Driven Defense Prompts: Aimed at initial-turn protection by forcing agents to reason about the cumulative effects of their actions; initially reduced ASR by 28.8%.
  • Defense Erosion: Effectiveness of reasoning-based prompts significantly diminishes when faced with adaptive, multi-turn attack strategies.
  • ToolShield: A proposed experience-based defense mechanism designed to provide more durable, sequence-aware protection than standard prompt-based filters.
• Conclusion: The Need for Behavioral Monitoring
  • Current LLM security guardrails and traditional EDR-style monitoring are insufficient for autonomous agent orchestration.
  • Future defense requirements must prioritize continuous monitoring of cumulative tool-use history and state changes.