LLM agents that use tools — file systems, databases, APIs, code interpreters — are tested for vulnerabilities one tool at a time. Can the agent be tricked into executing arbitrary code? Can it leak data from its context? These single-tool vulnerabilities are well-studied. But agents chain tools together: output from one tool becomes input to another, and data persists between invocations.
Wu et al. (arXiv:2603.12614) build ChainFuzzer, a greybox fuzzer that targets multi-tool composition vulnerabilities — security flaws that emerge only when tools are combined in sequence. A file-write tool might sanitize its input correctly. A database-read tool might sanitize its output correctly. But when the database output is passed to the file-write tool through the agent's reasoning, the intermediate representation may bypass both sanitizations.
Testing across 20 open-source LLM agent applications containing 998 tools, ChainFuzzer found 365 unique reproducible vulnerabilities across 19 applications. 302 of these required multi-tool execution — they don't exist in any single tool and only appear when tools are composed. The composition creates attack surface that neither tool's developer anticipated because each tool was designed and tested in isolation.
The technical approach: extract candidate tool chains from dataflow dependencies (what can flow from tool A's output to tool B's input), synthesize prompts that reliably execute these chains through the LLM agent's reasoning, then fuzz the inputs with guardrail-aware mutations that evade the agent's safety checks. The guardrail awareness is critical — naive fuzzing triggers the agent's refusal mechanisms; adaptive fuzzing finds paths around them. Chain reachability improved from 27% to 95% with guided prompt synthesis.