Adversaries Can Misuse Combinations of Safe Models