What should organisations do differently when attackers can combine tools at runtime?

Why This Matters for Security Teams

When attackers can combine tools at runtime, they are no longer following a fixed playbook. They can swap scanners, credential harvesters, proxies, and automation steps on the fly, which makes static detection rules and brittle kill-chain assumptions much less reliable. That matters most for organisations with exposed secrets, service accounts, and overly broad token scopes. NHI Management Group’s Ultimate Guide to NHIs — Why NHI Security Matters Now shows how pervasive the identity gap already is, while Anthropic — first AI-orchestrated cyber espionage campaign report demonstrates that tool chaining is not theoretical anymore.

The practical risk is not just a single compromised credential. Runtime composition lets an attacker pivot from discovery to access, then to privilege escalation or data exfiltration, without needing a prebuilt sequence that defenders can signature in advance. Current guidance suggests identity and secret exposure are the main choke points, because tools only become dangerous when they inherit usable access. In practice, many security teams encounter the impact only after a routine workload token, API key, or CI credential has already been abused across multiple tools.

How It Works in Practice

Defence needs to shift from sequence-based assumptions to runtime control of identity, secrets, and policy. If an attacker can recompose tooling dynamically, then the important question becomes: what identities can each tool reach, what secrets are exposed at each step, and what policy is enforced at request time? That is why workload identity and ephemeral authorisation are more useful than static allowlists for autonomous activity.

A practical model uses short-lived credentials, bounded scope, and per-action policy evaluation. For agents and automated workflows, treat the workload itself as the identity primitive, not the operator or the source IP. Standards such as SPIFFE support strong workload identity, while CISA cyber threat advisories consistently reinforce containment, rapid revocation, and exposure reduction as core response measures. NHI Management Group’s Ultimate Guide to NHIs — Key Challenges and Risks highlights how often secrets remain valid long after they should have been removed.

• Issue JIT credentials per task, not long-lived tokens that survive across workflows.
• Reduce tool permissions to the minimum executable scope, then revoke on completion.
• Inspect identity touchpoints such as token minting, secret retrieval, and service-to-service calls.
• Instrument policy at runtime so new tool combinations are evaluated against current context.

For detection, prioritize signals like anomalous secret use, unusual token exchange patterns, and sudden expansion in tool reach rather than relying on one known sequence. These controls tend to break down in highly distributed environments with weak service inventory, because defenders cannot reliably tell which workload owns which credential once tool chaining starts.

Common Variations and Edge Cases

Tighter runtime control often increases operational overhead, requiring organisations to balance rapid automation against review burden and latency. That tradeoff is real, especially when pipelines are high-volume or when agents must call many downstream services in milliseconds. There is no universal standard for this yet, but current guidance suggests the safest pattern is dynamic authorisation with narrow, revocable access rather than broad standing trust.

Edge cases appear when tools are chained across cloud accounts, SaaS apps, or delegated agent frameworks. In those environments, a single policy gap can expose an entire path of reusable tokens. Organisations should also expect false confidence from perimeter alerts, because runtime tool combination can stay inside “approved” services while still performing hostile actions. The right response is to watch identity transitions, secret lifetimes, and privilege expansion. OWASP’s agentic AI guidance and the MITRE ATLAS adversarial AI threat matrix both reflect this shift toward behavior- and context-aware defence, and NHI Management Group’s 52 NHI Breaches Analysis shows how frequently identity abuse becomes the real entry point.

In practice, runtime tool combination is hardest to contain when secrets are embedded in code, tokens are long-lived, and service inventories are incomplete, because defenders cannot see the full attack path until it has already been chained together.

Related resources from NHI Mgmt Group

• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?
• Why do attackers often check model availability before trying to generate content?
• How do attackers turn stolen npm secrets into broader compromise?