Call Chains
A call chain is like a secret map showing how an AI agent connects different tools to get work done. If this map is exposed, hackers can see exactly which parts of the system are connected to dangerous "control buttons" and use those paths to trick the AI into running malicious commands.
Call chains represent the sequence of function calls and tool invocations defined within an AI agent's configuration. Adversaries analyze these chains to identify insecure data flows that link untrusted user inputs or LLM outputs directly to sensitive execution sinks, such as system shells or code evaluators, creating pathways for remote code execution via prompt injection.
In the context of AI security, call chains are the directed execution paths defined by an agent's orchestration logic, mapping the flow from input sources to execution sinks. Adversaries extract these configurations to perform static analysis, identifying vulnerable linkages where unsanitized LLM outputs reach dangerous primitives (e.g., exec, eval, os.popen). These identified chains serve as primary attack vectors for remote code execution (RCE) when triggered by adversarial prompt injection, facilitating systematic exploitation across applications utilizing the same vulnerable framework configurations.