PaperlayerView exact revision on arXiv

Source-linked AI summary

SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction

Yuting Ning, Zhehao Zhang, Yash Kumar Lal, Boyu Gou, Junyi Li, Weitong Ruan, Chentao Ye, Rahul Gupta, Diyi Yang, Yu Su, Huan Sun

arXiv:2606.02540v1cs.CL

TL;DR

Prior skill-attack studies largely evaluate one task execution and use benchmark-specific risk lists. SkillHarm evaluates attacks across the skill-use lifecycle and organizes risks by workflow component; current agents remain vulnerable in both attack scenarios.

  • Problem

    Existing skill-attack benchmarks largely assess poisoned skills within a single task execution and use benchmark-specific risk lists rather than a systematic account of skill-relevant risks.

    Source: §1 · p. 2

  • Method

    SkillHarm evaluates fixed-payload and self-mutating attacks across the skill-use lifecycle, organizes 12 risks by workflow component, and uses AutoSkillHarm to construct attack samples.

    Source: §1 · p. 2, §6 · p. 10

  • Results

    Agents remain vulnerable in both scenarios (FPP ASR up to 86.3%; SMP 69.3%), and most failures reflect agents not accessing injected files.

    Source: §1 · p. 2, §6 · p. 10

  • Takeaways & Limitations

    Neither skill scanners nor defensive prompts reliably mitigate the evaluated threat.

    Source: §1 · p. 2, §6 · p. 10

    The threat model assumes attackers publish poisoned packages but have no post-installation access to or visibility into victim environments.

    Source: §3.1 · p. 4

Abstract

from arXiv · show

Agent skills occupy a privileged position in the agent workflow, as agents are expected to implicitly follow and execute them, rendering third-party skills a vulnerable attack surface. Existing studies have revealed unsafe agent behaviors induced by skill-based attacks, but they primarily evaluate poisoned skills within a single task execution and enumerate harms through ad-hoc risk lists. To bridge these gaps, we introduce SkillHarm, a benchmark of skill-based attacks across the skill-use lifecycle, paired with a systematic taxonomy of skill-relevant risks. SkillHarm evaluates two attack scenarios: Fixed-Payload Poisoning (FPP), where a fixed poisoned skill package directly compromises any task session that invokes it, and Self-Mutating Poisoning (SMP), where an initially benign execution silently mutates persistent skill content, deferring harm until a subsequent reuse. It further defines 12 risk types based on the agent workflow component targeted by the harm: data pipelines, system environments, and agent autonomy. To instantiate these attacks at scale, we build AutoSkillHarm, an automated construction pipeline with coding agents driven by natural-language harnesses. The resulting benchmark contains 879 attack samples across 71 skills. Experiments show that current agents remain vulnerable with attack success rates up to 86.3% in FPP and 69.3% in SMP. Our analysis further reveals a latent risk: many apparent attack failures stem from the agent failing to engage with the poisoned file rather than genuine resistance, and current defenses still fail to reliably mitigate the threat.

1 Introduction

SkillHarm benchmarks skill-based attacks across direct and cross-session use and organizes skill-relevant risks systematically. Its results show substantial agent vulnerability, while AutoSkillHarm automates construction of the benchmark at scale.

1 Introduction

  • Earlier benchmarks largely judged attacks within one task execution and used ad-hoc risk lists, leaving skill reuse, mutation, and systematic risk coverage underexplored.Skill packages can persist across tasks, be reused across sessions, and be modified during execution.Source: §1 · p. 2
  • SkillHarm evaluates fixed-payload attacks that compromise invoking sessions and self-mutating attacks that defer harm until a later reuse, covering 12 risks across data processing, local environments, and delegated-agent behavior.SMP’s harmful behavior requires the compromised skill package to persist and be reused across tasks.Source: §1 · p. 2
  • AutoSkillHarm uses natural-language harnesses and coding agents to select reachable skill files and task pairs, instantiate contextualized payloads and deterministic evaluators, then filter invalid candidates.The harness for each stage specifies its inputs, objectives, constraints, outputs, and review criteria.Source: §1 · p. 2
  • FPP reaches ASR up to 86.3%, while SMP reaches 69.3% despite requiring successful skill mutation and harmful later reuse; SkillHarm contains 879 samples across 71 skills and 12 risk types.The evaluation covers six model-harness configurations across Claude Code, Codex, Gemini CLI, and OpenCode.Source: §1 · p. 2
  • Many apparent attack failures reflect agents not consulting the targeted skill file; conditional on engagement, ASR rises sharply, while refusal is rare and defenses do not reliably mitigate attacks.Only Claude-family models show noticeable, but still low, refusal rates; skill scanners miss substantial contextualized payloads, and defensive prompts fail to reliably reduce overall ASR.Source: §1 · p. 2

2 Related Work

Related work frames reusable skills as a privileged attack surface and identifies gaps in lifecycle coverage and scalable attack construction. SkillHarm addresses these gaps through cross-session evaluation, a workflow-grounded risk taxonomy, and coding-agent construction guided by natural-language harnesses.

Skill-Based Attacks

  • SkillHarm extends prior skill-poisoning benchmarks with direct single-session and deferred cross-session attacks plus 12 workflow-grounded risk types.The taxonomy organizes risks by the workflow components they target: data pipelines, system environments, and agent autonomy.Source: §2 · p. 3

Automated Attack Construction

  • Prior construction pipelines use limited templates or seed mutation (Feng et al., 2026; Tie et al., 2026), brittle fixed LLM workflows (Qu et al., 2026), or costly victim rollouts.Rollouts may overfit an assumed victim and conflict with attackers committing to reusable packages before installation; SkillHarm uses coding agents guided by a natural-language harness specifying stage objectives, constraints, and control flow.Source: §2 · p. 3

3 Threat Model and Attack Formulation

SkillHarm models skill attacks by when harm occurs in the skill-use lifecycle and which agent-workflow component is compromised. Its threat model assumes publishers control the distributed package but cannot access victim environments after installation.

3.1 Threat Model

  • Attackers are public skill publishers who control every package file and know the skill’s advertised purpose and intended task class.Controlled files include SKILL.md, reference documents, executable scripts, and auxiliary resources.Source: §3.1 · p. 4
  • After installation, attackers cannot observe or adapt to victim execution, so payloads must be reusable and trigger through ordinary use on relevant tasks.Victims install the skill, then agents load its instructions, references, and scripts when completing relevant tasks.Source: §3.1 · p. 4

3 Threat Model and Attack Formulation

  • The section distinguishes when harm materializes across the skill-use lifecycle from which workflow component the attack compromises.The first distinction separates same-session harm from harm deferred until reuse; the second organizes risks by targeted workflow component.Source: §3 · p. 3, §3.2 · p. 4, §3.3 · p. 5

3.2 Attack Scenarios

  • Fixed-Payload Poisoning (FPP) places a malicious payload in the installed skill, enabling harm in the same session when a relevant task reaches it.The payload may reside in instructions, references, helper scripts, or added artifacts referenced by original skill files.Source: §3.2 · p. 4
  • Self-Mutating Poisoning (SMP) appears harmless initially, silently alters persistent skill content, and causes harm only when a later session reuses it.This deferred compromise can escape single-session evaluation even when the initial task is completed.Source: §3.2 · p. 4
  • AutoSkillHarm uses a natural-language harness to drive target selection, contextualized payload design with deterministic evaluators, and quality filtering of invalid candidates.Target selection identifies reachable attack targets.Source: Figure 2 · p. 5

3.3 Risk Taxonomy

  • The taxonomy organizes 12 risk types by compromised workflow component: data pipelines, system environments, and agent autonomy.These cover task-data confidentiality or integrity, the skill-exposed execution substrate, and delegated authority, respectively.Source: Table 2 · p. 4, §3.3 · p. 5

4 Automated Skill-Attack Construction

SkillHarm uses AutoSkillHarm, a coding-agent pipeline guided by natural-language harnesses, to construct attacks across two scenarios and 12 risk types. Its shared three-stage process selects targets, designs attacks, and filters candidates for quality.

4 Automated Skill-Attack Construction

  • AutoSkillHarm uses stage-specific natural-language harnesses to guide coding agents through a shared construction procedure across scenarios and risks.Each harness specifies objectives, inputs, tools, constraints, outputs, review criteria, and stopping conditions; the pipeline has target-selection, attack-design, and quality-filtering stages.Source: §4 · p. 5

4.1 Attack Target Selection

  • FPP targets exposed skill files in individual tasks, while SMP targets task pairs that reuse a skill and can defer harm until later reuse.FPP retains files reached in at least 30% of benign trajectories, with at most three documentation files and three scripts per task. SMP pairs routine-use task TA with later task TB and aggregates candidate pairs proposed independently by three coding agents.Source: §4.1 · pp. 5–6

4.2 Attack Design

  • Attack designers turn each risk into a deterministically checkable harmful goal, modify skill files with plausible payloads, and evaluate whether the harm occurs.FPP uses in-place modifications or attacker-added artifacts; SMP uses an exit-triggered callback in TA to rewrite sibling skill files for loading during TB. Designers also refine payload plausibility and may use an LLM detector to flag suspicious content.Source: §4.2 · p. 6

4.4 Benchmark Statistics

  • 879 runnable attack samples—687 FPP and 192 SMP—span 12 risk types in the final SkillHarm benchmark.Each sample includes a Docker environment, task or task pair, poisoned skill files, and a deterministic attack-success evaluator.Source: Table 3 · p. 6, §4.4 · p. 7

4.3 Quality Filter

  • The quality filter retains 70% of generated candidates after two victim-agent executions and a separate trajectory-grounded reviewer checks feasibility, plausibility, and evaluator validity.Validation runs use Claude Code with Sonnet 4.6 and Codex with GPT-5.4; their trajectories are evidence for review and are not returned to designers for revision.Source: §4.3 · p. 6

5 Experiments

Across the tested configurations, agents remained vulnerable in both attack scenarios, while further analyses show that engagement, refusal, payload form, defenses, and model–harness choices shape observed risk.

5.1 Experimental Setup

  • The evaluation covers six model–harness configurations and measures FPP after one execution and SMP after a mutated skill is reused in a subsequent task.It reports ASR, conditional ASR (cASR) when the agent engages with the target payload file, and attack refusal rate (ARR).Source: §5.1 · p. 7

5.2 Main Results

  • FPP ASR reached 86.3%, while SMP ASR reached 69.3%; Codex agents were most vulnerable in both scenarios and Opus 4.7 had the lowest ASR.SMP requires persistent mutation and cross-session reuse, yet still reached the reported ASR.Source: §5.2 · p. 7
  • Engagement-conditioned success reveals latent vulnerability; only Claude-family agents noticeably refuse, refusals fall in SMP, and script payloads often succeed despite resistance to overt data-flow harms.Conditioning on engagement raises success by up to 32.1% for Claude Opus 4.7 in SMP; Sonnet 4.6 ARR falls from 25.3% in FPP to 2.1% in SMP. Attacks succeed across risk types, but agents are more resistant to overt harms such as data exfiltration.Source: §5.2 · p. 8

5.3 Further Analysis

  • The strongest scanner detects 55.6% of FPP and 68.8% of SMP injections, while defensive prompts leave nearly all configurations above 70% ASR in both scenarios.Contextualized injections frequently evade detection; prompts reduce ASR in some configurations, but existing defenses remain insufficient.Source: Table 5 · p. 8, §5.3 · p. 8, Figure 3 · p. 8

Harness-model Decoupling.

  • Under OpenCode, GPT-5.4 has lower ASR and cASR than under Codex, while Opus 4.7 has higher ASR than under Claude Code but still lower ASR and higher ARR than GPT-5.4.The findings indicate that vulnerability depends on the full model–harness stack, with safety mechanisms needed at both levels.Source: Table 7 · p. 9, Harness-model Decoupling · p. 9

5.3 Further Analysis

  • Poisoned skills preserve similar task success for most configurations, but Opus 4.7 task success drops by 13.8%, consistent with stronger refusal behavior.A cautious agent may reject suspicious content and thereby also miss benign skill content needed for task completion.Source: Table 6 · p. 9, §5.3 · p. 9
  • The designer invokes its detector 3.8 times per design on average; 84% of designs use it multiple times, and 13% of attacks initially flagged benefit from revision.Although instructions already guide stealthy payloads, 87% of generated attacks pass the detector within two attempts.Source: §5.3 · p. 9

Ablation of Designer Agent.

  • FPP attacks achieve the same average ASR across the two designers, whereas SMP is more designer-sensitive and Opus 4.7 produces stronger attacks across victims.The results suggest the design pipeline works with different designers, while complex lifecycle attacks benefit from a stronger designer.Source: Ablation of Designer Agent · p. 9, Table 8 · p. 10

6 Conclusion · Appendix

SkillHarm benchmarks skill-based attacks across the skill-use lifecycle and 12 workflow-component risk types. Its evaluation finds persistent agent vulnerabilities, with many apparent failures caused by agents not accessing poisoned files rather than resisting the attacks.

6 Conclusion

  • Most attack failures stem from agents never accessing the injected file, while cross-session temporal separation further suppresses refusal behavior.The harmful outcome follows a preparatory mutation in a later session.Source: §6 · p. 10
  • SkillHarm evaluates skill-based attacks across single-session and cross-session scenarios and 12 risk types organized by affected workflow component.The benchmark addresses vulnerabilities across the skill-use lifecycle.Source: §6 · p. 10
  • AutoSkillHarm uses coding agents and natural-language harnesses to build an automated, scalable, and extensible attack-construction pipeline, producing 879 diverse samples.Source: §6 · p. 10
  • The evaluation finds all current agents highly vulnerable to skill-based attacks.Source: §6 · p. 10
  • Neither scanners nor defensive prompts reliably mitigate the threat.Source: §6 · p. 10
  • The authors release SkillHarm to support defenses addressing the trust agents place in skill content.They characterize skill-based attacks as a distinct, under-examined part of the agent-security landscape.Source: §6 · p. 10

A Comparison with Related Benchmarks · Risk taxonomy.

SkillHarm distinguishes itself by evaluating attacks that persist across sessions and by organizing skill-specific risks around the agent workflow. Its construction emphasizes diverse attack strategies and payload forms, while its primary ASR uses deterministic evaluation.

A Comparison with Related Benchmarks

  • SkillHarm adds cross-session attacks, where a skill is mutated in one session and later compromises a session that reuses it, exposing failures single-session evaluations miss.Prior benchmarks evaluate attacks within a single session.Source: A Comparison with Related Benchmarks · p. 14

Risk taxonomy.

  • SkillHarm defines 12 risk types across data pipeline, system environment, and agent autonomy, replacing limited flat lists such as PoisonedSkills’ inherited taxonomy and SkillJect’s four ad hoc risks.The categories identify where in the agent workflow a compromise occurs, supporting systematic coverage and per-category robustness analysis.Source: Risk taxonomy · p. 14
  • Prior construction methods trade scale, diversity, and cost: generated batches may share attack logic, while manual and victim-in-the-loop approaches are narrow, costly, or prone to agent-specific overfitting.SkillTrojan (Feng et al., 2026) reports 3,000+ samples using a shared attack strategy; PoisonedSkills (Qu et al., 2026) mutates 81 seeds into 1,070 variants. Manual design (Schmotz et al., 2026) and victim-in-the-loop methods (Jia et al., 2026; Duan et al., 2026) have scope, cost, or overfitting limitations.Source: Risk taxonomy · p. 14
  • Each SkillHarm sample is independently designed for its target skill and risk type without victim-agent interaction, reducing shared-strategy collapse and victim-specific overfitting.A designer agent explores the skill and selects a viable attack strategy; SkillHarm prioritizes attack diversity over raw sample count.Source: Risk taxonomy · p. 14
  • For FPP, SkillHarm varies payload delivery across four document-target forms and two script-target forms, enabling analysis of effectiveness and stealth beyond benchmarks’ single fixed mechanisms.Forms include prose or code inserted in the original file, and routing or imports that invoke attacker-added files or scripts.Source: Risk taxonomy · p. 14
  • SkillHarm measures primary ASR with deterministic scripts that check end-state artifacts; LLM judgment is reserved for conditional ASR and refusal rate, which require trajectory-level semantic analysis.This avoids the non-determinism and potential judge bias of using LLM-as-a-judge for primary attack success.Source: Risk taxonomy · p. 14

B Benchmark Construction Details … B.3 Quality Filter Details

The appendix details AutoSkillHarm’s target selection, attack construction, and quality filtering, including how samples are selected, made reusable, and checked before inclusion.

B Benchmark Construction Details

  • The appendix describes AutoSkillHarm’s construction workflow, where designer agents explore unmodified skill packages and task environments using a harness that specifies a target risk type.Optional SkillsBench trajectories show file reads and script executions; task environments and trajectories are construction-time scaffolding, not information available to real attackers, and payloads must be reusable rather than prompt-specific.Source: B Benchmark Construction Details · p. 15, §B.2 · p. 15

B.1 Target Selection Details

  • For FPP, files with read rates of at least 0.30 were retained, with per-task caps of three documentation files and three scripts, yielding 142 injection points.The points comprised 106 documentation files and 36 scripts; 23 tasks were excluded for lacking qualifying files or having dispersed invocation patterns.Source: §B.1 · p. 15
  • For SMP, three selector agents scored task pairs on feasibility and impact from 1 to 10, and votes × feasibility × impact yielded 12 pairs across unanimous, majority, and single-vote tiers.Each tier contained four pairs.Source: §B.1 · p. 15

B.2 Attack Design Details

  • FPP payloads use in-place modification or routing: document carriers can redirect to a new Markdown file, script, or PDF, while scripts can import a new helper module.The other realizations rewrite the original document or script in place; routed PDFs hide payloads as white-on-white text.Source: §B.2 · pp. 15–16
  • In SMP, an atexit callback silently rewrites a sibling skill file after Task A, so harmful content activates when Task B reuses the skill.The callback updates framework-specific skill directories to improve coverage; task Dockerfiles can seed required files, directories, environment variables, copied paths, or mock services.Source: §B.2 · p. 16
  • Attack evaluators check only the harmful end state, independent of payload realization, using deterministic self-contained code without LLM calls or randomness.Benign task success is scored separately by the original task tests.Source: §B.2 · p. 16

B.3 Quality Filter Details

  • Each candidate underwent end-to-end testing on Claude Code Sonnet 4.6 and Codex GPT-5.4, followed by trajectory-grounded review of goal validity, evaluator faithfulness, and payload quality.Samples were discarded for construction-level flaws such as unreachable goals, unfaithful evaluators, or weak framing.Source: §B.3 · p. 17
  • 47% of filtered designs failed from weak cover stories, 32% from infrastructure failures, 9% from payload placement, 6% from evaluator false positives, 4% from dependency mismatches, and 2% from other issues.Other issues included implementation bugs in atexit callbacks.Source: §B.3 · p. 17

C Detailed Benchmark Statistics … D Experimental Details

The benchmark comprises separate FPP and SMP evaluation sets, with 687 and 192 samples, respectively. The supplied passages describe their task–skill pairing scopes and associated distribution figures.

C.1 Fixed-Payload Poisoning

  • FPP covers 57 tasks and 71 skills, forming 126 unique task–poisoned-skill combinations and 687 samples across the risk taxonomy and six payload realizations.Figure C.1 reports the sample distribution across 12 risk types and six payload realizations.Source: §C.1 · p. 17

C.2 Self-Mutating Poisoning

  • SMP covers 12 task pairs and six skills, forming 15 unique task-pair–poisoned-skill combinations and 192 samples across the risk taxonomy.Figure C.2 reports the sample distribution across 12 risk types.Source: §C.2 · p. 17

D.1 Evaluation Metrics … E.2 Harness–model Decoupling

SkillHarm’s supplementary analyses define engagement-aware metrics and show that attack success varies with risk type, payload form, defensive prompts, and the model–harness combination. Together, they indicate that neither prompt warnings nor model-level safety alone reliably address the vulnerability.

D.1 Evaluation Metrics

  • Conditional ASR measures attack success among samples judged to use the target file, while Attack Refusal Rate measures samples judged to refuse the auxiliary goal.LLM-as-a-Judge classifies file engagement, identification of suspicious content, and refusal; ASR uses deterministic evaluators over the full sample set with one run per configuration, while cASR and ARR aggregate over all samples.Source: §D.1 · pp. 18–19

D.2 Result Breakdown by Risk and Realization

  • Data-pipeline exploitation has the lowest ASR across the three risk categories in both settings, with data exfiltration lowest across agents.The passage suggests agents are more resistant to overt data-flow harms, such as sending data to an external endpoint.Source: §D.2 · p. 19
  • Script-mediated payloads achieve substantially higher ASR than document-based payloads, as agents often execute trusted helper scripts without inspecting them.The analysis identifies a gap between defenses for natural-language indirect prompt injection and skill attacks encoded in scripts.Source: §D.2 · p. 19

E.1 Defense with Defensive System Prompt

  • The defensive system prompt warns agents to inspect skill files and scripts, follow the user’s task, and disregard malicious or conflicting content.The warning is appended through each coding agent’s supported prompt or configuration mechanism.Source: §E.1 · p. 20
  • Nearly all evaluated agents remain above 70% ASR in both settings despite defensive system prompts, making prompt-level warnings an unreliable mitigation.The defense is tested on a high-ASR subset selected by ranking samples within each risk type and retaining the top 30% by mean ASR across six victim agents.Source: §E.1 · p. 20

E.2 Harness–model Decoupling

  • Harness choice changes attack outcomes, and the results indicate that skill-attack vulnerability depends on the full model–harness stack.For GPT-5.4, switching from Codex to OpenCode reduces ASR and cASR in both settings; Opus 4.7 has higher SMP ASR under OpenCode than under Claude Code, but under OpenCode it still has lower ASR and higher ARR than GPT-5.4.Source: §E.2 · p. 21
  • With GPT-5.4, switching from Codex to OpenCode reduces ASR and cASR in both FPP and SMP, indicating that the Codex harness amplifies attack success.The comparison fixes the model and varies the harness.Source: §E.2 · p. 21
  • Under the same OpenCode harness, Opus 4.7 has lower ASR and higher ARR than GPT-5.4, showing that model-level safety also matters.The analysis compares Opus 4.7 and GPT-5.4 under OpenCode, while also finding that Opus 4.7’s low ASR under Claude Code is partly attributable to that harness.Source: §E.2 · p. 21

E.3 Ablation of Designer Agent · F Analysis of Refinement Iterations · F.1 Quantitative Overview

Across designer ablations and refinement analysis, FPP effectiveness is largely designer-robust, while SMP benefits from the stronger designer. Most designs undergo repeated detector scans, but few require revisions after a critical flag, suggesting evasion reasoning is front-loaded.

E.3 Ablation of Designer Agent

  • FPP achieves the same average ASR with Claude Code (Opus 4.7) and Codex (GPT-5.4), while each designer’s attacks transfer slightly better across model families.FPP attack design was rerun on a randomly sampled 30% subset.Source: §E.3 · p. 21
  • Claude Code (Opus 4.7) produces stronger SMP attacks across victims, indicating that complex lifecycle attacks benefit from a stronger designer.The SMP comparison uses the full set because it is smaller.Source: §E.3 · p. 21

F Analysis of Refinement Iterations

  • The analysis traces how iterative self-refinement shapes attack design through interactions with an LLM-based detector.Its structured repertoire is analyzed by the level at which the designer refines the attack.Source: F Analysis of Refinement Iterations · p. 21
  • The refinement analysis organizes designer iterations into surface reframing, attack-mechanism redesign, and payloads intrinsically indistinguishable from legitimate behavior.The analysis examines refinement trajectories without providing a specific detector-evasion tactic.Source: F Analysis of Refinement Iterations · pp. 21–22

F.1 Quantitative Overview

  • 3.9 detector invocations per FPP design and 3.7 per SMP design on average; 82–88% of designs undergo at least two scan–revise cycles.The table defines detector-triggered revisions as designs where a detector invocation flags a critical finding attributable to the injected payload, prompting modification.Source: Table F.1 · p. 22, §F.1 · p. 22
  • Only 12% of FPP and 14% of SMP designs require active evasion revisions after a critical detector flag; the rest evade on early attempts.This suggests the designer front-loads evasion reasoning rather than discovering it reactively.Source: §F.1 · p. 22

F.2 Surface-Level Evasion · F.3 Structural Evasion · F.4 Intrinsically Undetectable Constructions

These sections show how attacks evade detection by changing their presentation or mechanism, while some harmful operations are indistinguishable from legitimate ones and leave detection inapplicable.

F.2 Surface-Level Evasion

  • Declarative reframing, domain-native terminology, and generic triggers evade linguistic heuristics; the DOI-cache reformulation achieved zero detection while preserving the poisoning payload.The detector flagged imperative wording but tolerated the same payload presented as a factual description of cache behavior.Source: §F.2 · p. 22
  • Code-block embedding achieved 100% evasion across five scans, exploiting detectors’ treatment of code as inert despite agents copying and executing examples.The attack concealed goal-hijacking behavior in a reference pdfplumber code block.Source: §F.2 · p. 22
  • After financial-specific and conditional framings were flagged, generic pdfplumber calibration language passed with a non-critical warning while retaining forensic-log truncation.The designer reached this generic framing after 17 iterations.Source: §F.2 · pp. 22–23

F.3 Structural Evasion

  • For exfiltration, goal hijacking, and malware deployment, core semantics trigger detection regardless of cover story, prompting mechanism redesign rather than rewording.The harmful mandate cannot be removed without breaking the attack, so the designer instead seeks to reduce its detectable surface.Source: §F.3 · p. 23
  • When HTTP transmission of document-derived content was detected, the payload sent page_count, chars, and fingerprint[:16] while staging full text locally as a telemetry ping.This shrank the detectable footprint to a benign-looking metrics call.Source: §F.3 · p. 23
  • The designer replaced detected SSH persistence with a PYTHONSTARTUP telemetry hook, and staged exfiltrated data in the skill-directory snapshot to cross containers unseen.The hook was framed as GaMMA multiprocessing worker telemetry; the SMP side channel stored content in scripts/.preflight_cache/ as a skill-cache artifact.Source: §F.3 · p. 23

F.4 Intrinsically Undetectable Constructions

  • A single .title() call remapped extracted IT and QA labels but not Excel values, creating phantom changes through a legitimate-looking normalization step without detector iterations.Applying the transformation to only one comparison branch made it indistinguishable from routine data-quality processing.Source: §F.4 · p. 24
  • A standard content-type gate checked for embedded .xlsx files and injected a financial-advisory string into the worksheet, leaving no inherent malicious signal for detectors.The trigger exploited the difference between Task A, which had no embedded workbook, and Task B, which did.Source: §F.4 · p. 24

Related papers

Loading 2606.02540v1…