{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.01564", "title": "Chaining Skills to Hijack LLM Agents", "summary": "This is an attack paper, not an optimization: APEX replaces single-skill prompt injection with multi-skill chains in which an agent-written progress record carries a false user-approval claim into a downstream attacker-selected action, succeeding in 512 of 690 attempts (74.2%; 84.3% on GPT-5.4 versus 17.4% when the workflow is merged into one skill). Adopting the lesson costs engineering effort rather than compute: restrict skill chaining from open-source repositories, treat skill-produced files as untrusted input, and gate consequential actions behind explicit user confirmation; the paper's own prompting defense cuts success to 59.1% but drops benign task pass rates from 86.7% to 56.3%, so that defense has a real quality cost. What can fail: prompt-based verification is bypassable and degrades legitimate performance, so teams relying on it alone retain a large residual attack surface.", "rationale": "The reader deploying agents with third-party skills faces this exact threat model, and the actionable mitigations (skill provenance controls, human approval for sensitive actions) are cheap to test but require workload-specific validation because the evaluated defense halves benign task success.", "technique": "Adversarial skill chaining across LLM agent workflows", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-10-01", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.01564", "independent_implementations": 0, "total_implementations": 0, "stars": 0, "citations": null, "claims": [ { "claim_id": "claim-01", "statement": "This is an attack paper, not an optimization: APEX replaces single-skill prompt injection with multi-skill chains in which an agent-written progress record carries a false user-approval claim into a downstream attacker-selected action, succeeding in 512 of 690 attempts (74.2%; 84.3% on GPT-5.4 versus 17.4% when the workflow is merged into one skill). Adopting the lesson costs engineering effort rather than compute: restrict skill chaining from open-source repositories, treat skill-produced files as untrusted input, and gate consequential actions behind explicit user confirmation; the paper's own prompting defense cuts success to 59.1% but drops benign task pass rates from 86.7% to 56.3%, so that defense has a real quality cost. What can fail: prompt-based verification is bypassable and degrades legitimate performance, so teams relying on it alone retain a large residual attack surface.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.01564", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }