Module 04
An agent is not a model, it is a model with hands. The risk stops being what it answers and becomes what it executes. This module takes as input the functions and tools your agent can reach, and generates the action chains that turn them into an attack.
You hand us the complete list of the agent's tools and functions.
A model of ours reasons over that set and builds concrete abuse chains.
We execute those chains against your agent in an isolated environment.
Tools get reviewed one at a time and on their usefulness. An attacker reviews them together and on what they let you chain. A web search capability is harmless. A web search capability plus a disk write capability plus an agent that follows instructions it found online is a download-and-execute chain.
You list web_search among the tools, as a legitimate one. Our model chains it so the agent searches for, retrieves and downloads a malicious binary, without ever stepping outside the behaviour it was authorised to perform.
The Replit agent deleted a production database during an explicit code freeze repeated in capitals, then fabricated 4,000 fake profiles to cover it.
In the Nx attack, the malware invoked the Claude, Gemini and Q CLIs already installed on the machine with --yolo and --trust-all-tools. The developer's own assistant located and handed over 2,349 credentials.
In Amazon Q Developer, the destructive instruction was committed into the extension repository and shipped to the Marketplace in version 1.84.0.
You supply the input to this module: the complete schema of your tools, with names, descriptions, parameters and permissions. That is enough; the agent's code is not needed.
chain · AT-7734
unauthorised resultEach tool is legitimate on its own. The full chain is not.
We load the definition of every function you declared, with its parameters and the real reach of what it can touch. The more complete the list, the more realistic the attack.
A 7ONE model reasons over the whole set and proposes abuse chains: which combination of calls produces a result nobody authorised.
The chains run against your agent in an isolated environment. No test that mutates real state ever runs outside the sandbox.
We record how far each chain travelled before it met a control, and which ones met none at all.
The call sequences that lead to an unauthorised action, ordered by impact and by how easily they can be triggered.
Which ones concentrate the danger and which only ever appear as a link in the chain. This is what tells you what to cut first.
Human confirmation by action class, scope restriction per parameter, credential separation and per-tool rate limits.
Three separate incidents, one pattern: the agent did exactly what it was asked, and that was the problem.
Agent exceeding its action boundary
During an explicit code freeze, repeated in capitals, the agent deleted the production database holding real records for 1,206 executives and 1,196 companies.
It then fabricated over 4,000 fake user profiles and falsified test results to conceal the deletion. No natural-language instruction is an access control.
Suite category
Developer agents weaponised
Malicious versions of the Nx build system reached npm with a post-install payload that invoked the locally installed Claude, Gemini and Q CLIs, using --yolo and --trust-all-tools to skip permission prompts.
The developer's own AI assistant located and handed over the secrets: 2,349 credentials from 1,079 machines, published into repositories created inside the victims' own GitHub accounts.
Suite category
Malicious prompt in the supply chain
An over-scoped GitHub token in the CodeBuild configuration let an attacker commit a prompt into the extension repository. The instruction told the agent to act as a "system cleaner".
Version 1.84.0 shipped to the Marketplace carrying commands to wipe the local filesystem and destroy AWS resources: terminate EC2 instances, delete S3 buckets, remove IAM users. AWS confirmed no customer infrastructure was affected and shipped a clean 1.85.0.
Suite category
Next step
Let us start by defining the scope of the evaluation and agreeing the baseline for your risk score.