Problem

HackAgent’s only true multi-turn technique today is Crescendo (conversational escalation). It does not cover Sequential Tool Attack Chaining (STAC): multi-turn prompts that induce the agent to execute a verified malicious sequence of individually benign-looking tools, where the harm emerges from the chain rather than any single call.

Taxonomy

Register as AttackCategory.MULTI_TURN + AttackTag.INDIRECT. Tag indirect because the attack abuses the tool/environment interface (chains of tool use), not a single static prompt transform.

Multi-turn (not adaptive search): the attack maintains a growing interaction with the agent across turns to realize the chain. Not Crescendo’s pure chat escalation — the timeline is tool-centric.

Scope for v1

1. Synthesize or load executable multi-step tool chains that are harmful only in combination.
2. Drive a multi-turn dialogue that induces the agent to execute the chain.
3. Validate success via in-environment execution / tool-call traces (not final-text judges alone).
4. Cover a small set of failure modes from the STAC paper as an initial suite.
5. Docs + taxonomy + CLI/TUI wiring; traces should render as a tool-chain timeline under the multi-turn lens.

Out of scope

• Single-observation tool-output IPI (feat(attacks): tool-output indirect prompt injection (IPI/OPI) #598).
• Tool document / selection hijacking (ToolHijacker) — separate.
• Pure chat jailbreaks without tools (Crescendo already covers conversational multi-turn).

References

• STAC: When Innocent Tools Form Dangerous Chains to Jailbreak LLM Agents (arXiv:2509.25624).

Acceptance criteria

• New attack_type registered as multi_turn + indirect
• Docs page with taxonomy line and how traces are structured
• CLI/TUI discoverable
• Success metric based on chain execution, not only response text
• Tests for at least one end-to-end chain scenario