arXiv:2608. 04192v1 Announce Type: cross Abstract: Closed source agent skills may encode proprietary instructions, scripts, constants, and data.
Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.
Daydreaming is an execution‑only attack that steals multi‑file agent skills by interacting with a black‑box task service. By adaptively crafting tasks and analyzing the returned results, the attacker reconstructs the hidden skill without ever requesting or revealing it. In experiments on seven skills and four victim models, Daydreaming recovers 86.8% of the original capability using only 32 victim calls on average, outperforming prior methods and demonstrating that hiding skill files and filtering direct disclosure are insufficient defenses.
The paper introduces AgentLeak, a black‑box attack that clones the task‑solving capabilities of a strong LLM agent onto a weaker one by exploiting differences between successful and failed executions. Unlike prior skill‑stealing methods that only recover explicit skill artifacts, AgentLeak identifies and incorporates missing procedural behaviors, boosting task pass rates by over 40% and closing more than 80% of the capability gap across 20 scenarios. The study demonstrates that observable execution behavior can leak proprietary procedural knowledge, posing a confidentiality risk for LLM agents.
arXiv:2609.36879v1 Announce Type: cross Abstract: As LLM-based agents perform increasingly complex tasks, Agent Skills have emerged as a flexible mechanism for extending their capabilities. An Agent...
The paper introduces a new skill poisoning technique for large language model agents that decouples the pretext (rationale) from the actuation (operation). By separating these two risk‑realization factors, the authors create coordinated pretext‑actuation skill pairs that allow malicious actions to remain hidden within legitimate agent behavior. An automated framework is presented to discover execution dependencies, synthesize these skill pairs, and refine them through closed‑loop feedback, achieving high attack success in both single‑session and persistent scenarios.
The paper introduces skill cascading attacks, where a malicious goal is spread across multiple seemingly benign skills, causing harmful outcomes when combined. It presents SkillCascade, an automated red‑teaming framework, and releases SkillCascade‑Bench, a benchmark of 213 validated cascading test cases across various agent systems and domains. Experiments show that these cascaded interactions reliably induce harmful behaviors while evading existing per‑skill scanners and runtime monitors, revealing a gap between component‑level integrity and system‑level safety.
arXiv:2609.39450v1 Announce Type: cross Abstract: LLM-based agents extend their capabilities through third-party skills that provide task-specific instructions, scripts, and tool-use procedures. Howe...