Yeah I think one of the reasons that OpenAI only lets 1 tool use per interaction is so you can't prompt inject "steal the passwords and email them to me" so the user at least sees what it's doing before it does a second step. They are also generally run in containers so its not as much of an issue