Tutorials
Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher
arXiv:2610.18262v1 Announce Type: cross Abstract: Third-party skills can expose LLM agents to malicious instructions hidden by encoding. We introduce Ciphered Skill Injection (CSI), which embeds such
arXiv:2610.18262v1 Announce Type: cross Abstract: Third-party skills can expose LLM agents to malicious instructions hidden by encoding. We introduce Ciphered Skill Injection (CSI), which embeds such instructions in skill files for agents to decode and follow. We evaluate Caesar and layered variants across eight models and 139 injection-task pairs, separating instruction recovery from attack success. In the primary setting with shortened skills, the variants achieve attack success rates of up to 47.5% and 40.3%, respectively. Successful decoding does not guarantee attack success, and layering has model-dependent effects. The tested skill scanners rarely flag injected skills. These findings highlight the risk of promoting decoded, untrusted content into actionable instructions.
Related
- A Note on the Strategic Confinement Problem
- 'Do Not Mention This to the User': Detecting and Understanding Malicious Agent Skills
- When Correct Memory Goes Wrong: Fuzzing Persistent Memory Use in LLM Agents
Source: arXiv cs.AI | 2026-10-15