mlsanityData to 14 Oct 2026

Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher

arXiv 2610.18262 ↗First posted 13 Oct 2026cs.CR cs.AI cs.CLcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance also fits: Agent skill learning and evolution

Abstract (arXiv)

Third-party skills can expose LLM agents to malicious instructions hidden by encoding. We introduce Ciphered Skill Injection (CSI), which embeds such instructions in skill files for agents to decode and follow. We evaluate Caesar and layered variants across eight models and 139 injection-task pairs, separating instruction recovery from attack success. In the primary setting with shortened skills, the variants achieve attack success rates of up to 47.5% and 40.3%, respectively. Successful decoding does not guarantee attack success, and layering has model-dependent effects. The tested skill scanners rarely flag injected skills. These findings highlight the risk of promoting decoded, untrusted content into actionable instructions.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 20 of its 41 references that are in the map. First posted on arXiv 13 Oct 2026.

Builds on

20 of 41 references.

Closest ancestors · 15

Same direction, newest first

  1. 2026CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills17 Aug
  2. 2026ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP25 Jun
  3. 2026PhantomSkill: Malicious Code Injection in Agent Skill Ecosystems17 Jun
  4. 2026Dynamic Malicious Skills in Agentic AI15 Jun
  5. 2026Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems13 Jun
  6. 2026When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems30 May
  7. 2026SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems8 Apr
  8. 2026SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement5 Apr
  9. 2026Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems3 Apr
  10. 2026How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study3 Apr
  11. 2026Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks23 Feb
  12. 2026SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents15 Feb
3 more
  1. 2026When Skills Lie: Hidden-Comment Injection in LLM Agents11 Feb
  2. 2026Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale15 Jan
  3. 2025Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections30 Oct

Other references · 5

  1. 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,455
  2. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  3. 2024Found in the Middle: Calibrating Positional Attention Bias Improves Long Context Utilizationcited by 101
  4. 2026SWE-Skills-Bench: Do Agent Skills Actually Help in Real-World Software Engineering?cited by 82
  5. 2026Chaining Skills to Hijack LLM Agentscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents
  2. 2026Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills
  3. 2026SkillSecurer: Detecting and Patching Prompt-Injection Vulnerabilities in AI Agent Skills
  4. 2026Towards a Risk Assessment of Malicious Skill Files in Coding Agents
  5. 2026"Do Not Mention This to the User": Detecting and Understanding Malicious Agent Skills in the Wild
  6. 2026Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents
  7. 2026Seeing Is Not Screening: Multimodal Hidden Instruction Attacks on Agent Skill Scanners
  8. 2026SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills