AI Systems Atlas

S-10Privilege Escalation

/security/privilege-escalation

Individually-safe tools compose into a capability nobody granted.

Step-by-step walkthrough2 variants · 8 steps

Attack

  1. Each tool passed review — individually.
  2. Read the config to find privileged paths…
  3. …write a cron entry there…
  4. …and wait for the scheduler to run it as root.
  5. The composition holds a capability no single tool was granted.

Defended

  1. The read happens — it really is safe alone.
  2. The policy layer sees the chain, not just the call: sensitive read, then a persistence write.
  3. Known escalation compositions are blocked even when every step is allowlisted.
Key insight

Review tool sets, not tools: the question is never “is this call safe?” but “what can the union of these calls build?”

Failure mode

Allowlists that reason per-call: read-config, write-cron and run-script each pass review; together they are root.

Further reading
RelatedConfused deputyDirect prompt injectionPermission policies

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →