Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher
We introduce Ciphered Skill Injection (CSI), which embeds such instructions in skill files for agents to decode and follow.
ProofPaper ↗
Key points
- Third-party skills can expose LLM agents to malicious instructions hidden by encoding.
- We evaluate Caesar and layered variants across eight models and 139 injection-task pairs, separating instruction recovery from attack success.
- Successful decoding does not guarantee attack success, and layering has model-dependent effects.
- These findings highlight the risk of promoting decoded, untrusted content into actionable instructions.
Sources (1)
- [1]Encrypted Skills Can Become New Security Exploits If AI Agents Know How to DecipherarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 13, 12:25 PM
We introduce Ciphered Skill Injection (CSI), which embeds such instructions in skill files for agents to decode and follow.
Third-party skills can expose LLM agents to malicious instructions hidden by encoding.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 13, 2026Into the Unknown: Benchmarking AI agents on open scientific research problems
- Oct 12, 2026[AINews] Meta Muse Wonder & Wonder Full: MSL’s Claude 5.5-tier Frontier Model
- Oct 12, 2026NB-Corp/gpt-with-taste: Better judgment. Better taste. Less ceremony. System instructions and source-aware steering for GPT in Codex.
- Oct 12, 2026Alibaba Qwen Introduces QwenGyre: Elastic Reinforcement Learning RL for XLong-Horizon Agents
- Oct 12, 2026AI models may be capable of self-replicating without access to a datacenter
- Oct 11, 2026RayenMlayeh/jevcrawl: MCP server and CLI that crawls websites for AI agents: finds the answer page 2x more often than Crawl4AI, 10x cheaper per answer than lettin