Invocation
Agent-to-Agent and Tool-Output Invocation
Autonomous Self-Invocation
Deconstructed and Staged Invocation
Indirect Untrusted-Content Invocation
MCP Invocation
Memory-Resident Invocation
Operator Invocation
Triggered and Delayed Invocation
- ID: IV008
- Created: 26th August 2026
- Updated: 26th August 2026
- Contributors: Nimer Kees, James Weston,
Deconstructed and Staged Invocation
Deconstructed and staged invocation occurs when a harmful objective is deliberately broken into a sequence of prompts, subtasks, role-play frames, or staged inputs that appear benign when reviewed individually. The synthetic subject may comply with each request in isolation, while the sequence composes into an unauthorized, prohibited, or harmful action.
This invocation creates an elevated exposure condition because the effective instruction is distributed across time. No single prompt may contain the full objective, but the chain may cause the synthetic subject to perform reconnaissance, generate instructions, prepare tools, retrieve sensitive data, call systems, or complete a workflow that would have been blocked if requested directly.
The primary risk is cumulative intent concealment. A user may launder a prohibited objective through small technical questions, partial requests, pretextual framing, defensive role-play, or staged task handoffs. The synthetic subject may treat each step as ordinary assistance while progressively assembling the capability, context, or action path needed for the final harmful outcome.
A related risk is machine-paced staging. The sequence may show non-human timing, repetitive phrasing, short technical prompts, or sustained task progression without normal human exploration or browsing rhythm. These patterns may indicate that the synthetic subject is being driven through a deconstructed campaign rather than a legitimate interactive task.
Investigators should review the full prompt sequence, session history, cross-session activity, task tree, tool-call logs, non-human identity records, stated reasoning, role-play framing, and downstream actions. Particular attention should be given to individually benign prompts that form a recognizable chain, repeated short technical requests, pretextual security-testing claims, escalation from reconnaissance to exploitation or exfiltration, and actions whose purpose becomes clear only when the sequence is reconstructed.
Investigative Relevance
Deconstructed and staged invocation is relevant because synthetic subject behavior may be shaped by a campaign rather than a single prompt. The investigation must evaluate the cumulative objective of the interaction, not only whether each individual invocation appeared permitted.
This section is especially relevant where synthetic subjects assist with technical workflows, security analysis, coding, data retrieval, account operations, investigation tasks, tool use, or multi-step planning that can be deconstructed into benign-looking stages.