A chained attack is a multi-step abuse pattern where each individual prompt, response, or tool call appears acceptable, but the combined sequence is malicious. In agentic systems, the threat becomes visible only when the full session is analyzed, such as research, retrieval, and exfiltration occurring in one workflow.
Expanded Definition
A chained attack is not a single malicious prompt or one risky tool invocation. It is a sequence in which each step may look acceptable in isolation, while the overall workflow steadily advances toward recon, privilege abuse, data extraction, or policy bypass. In agentic systems, that sequence can span planning, retrieval, file access, external calls, and follow-on instructions, making intent harder to judge from any one action alone. NHI Management Group treats the term as a session-level abuse pattern, because the security question is not only what happened at each step, but what the chain accomplished end to end.
This concept is closely related to adversary chaining in traditional intrusion analysis, but the AI context adds a new layer: the system itself may amplify the attack by preserving state, reusing context, or taking actions on behalf of a user. That is why operational review often requires reconstructing the full conversation and tool history, not just the final output. The most common misapplication is treating each step as benign in isolation, which occurs when reviewers ignore how apparently safe actions combine into a malicious sequence.
Examples and Use Cases
Implementing detection for chained attacks rigorously often introduces review overhead, requiring teams to weigh better abuse visibility against slower agent execution and more logging.
- A research agent is first steered to summarise public documentation, then asked to enumerate internal assets, and finally instructed to package results for export. The individual requests seem ordinary, but the chain creates a reconnaissance-to-exfiltration path.
- An assistant is prompted to retrieve a file, then to transform its contents, then to hand the transformed data to another tool. Each step may satisfy policy, yet the sequence can move restricted information across boundaries.
- A malicious session uses harmless looking intermediate questions to build trust and context before issuing a final instruction that triggers unsafe tool use or credential exposure.
- An AI agent reads alerts, correlates logs, and is nudged to recommend containment actions that reveal sensitive workflow details to an external destination. The chain exploits the agent’s own orchestration logic.
- For a wider threat lens, incident responders often compare these sequences with known adversary patterns described in the MITRE ATT&CK Enterprise Matrix and with AI-specific abuse patterns in the MITRE ATLAS adversarial AI threat matrix.
Why It Matters for Security Teams
Chained attacks matter because they expose a blind spot in step-by-step policy enforcement. Security teams may have filters for prompts, allowlists for tools, and guards around individual outputs, yet still fail to detect a sequence that converts permitted actions into a harmful workflow. That is especially important in agentic environments, where an AI agent may have execution authority across multiple tools, data sources, or identities. In those cases, a chain can become a practical route from innocent task completion to unauthorized access, data leakage, or privilege misuse.
The identity connection is direct when chains involve secrets, session tokens, service accounts, or delegated permissions. Once an agent can act on behalf of a user or NHI, abuse becomes harder to distinguish from legitimate delegation unless telemetry preserves the full causal trail. Frameworks such as NIST SP 800-53 Rev 5 Security and Privacy Controls reinforce logging, access control, and monitoring expectations that help reconstruct the sequence after the fact. Organisations typically encounter the operational impact only after an incident review, at which point chained attack analysis becomes unavoidable to explain what the agent actually did.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Agentic AI abuse patterns include multi-step prompt and tool chaining. | |
| NIST AI RMF | AI RMF addresses governing and managing AI risks from chained misuse. | |
| NIST CSF 2.0 | DE.CM-1 | Continuous monitoring is needed to surface attack chains in session telemetry. |
| NIST SP 800-53 Rev 5 | AU-2 | Audit event definitions support reconstructing chained activity across tools. |
| OWASP Non-Human Identity Top 10 | NHI abuse often involves chained use of credentials, tokens, and delegated permissions. |
Review chained prompts, tool use, and state transitions as one abuse sequence, not isolated safe actions.
Related resources from NHI Mgmt Group
- How should security teams test LLMs for chained attack paths?
- What breaks when security teams rely on scanners to find chained attack paths?
- What breaks when AI safety systems do not understand chained requests as a single attack path?
- Why does Agentic AI make NHI attack surface expand so significantly?
