AI Systems Atlas

S-10Privilege Escalation

/security/privilege-escalation

Individually-safe tools compose into a capability nobody granted.

Key insight

Review tool sets, not tools: the question is never “is this call safe?” but “what can the union of these calls build?”

Failure mode

Allowlists that reason per-call: read-config, write-cron and run-script each pass review; together they are root.

Further reading
RelatedConfused deputyDirect prompt injection

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →