analiza aiqbench
This research exposes critical vulnerabilities in current AI agent defense mechanisms, demonstrating how attackers can bypass static checks and semantic filters using natural language payloads. The study reveals that existing scanners struggle against adaptive threats where malicious instructions are split across files or framed as legitimate tasks, achieving high evasion rates against both frozen and co-adaptive detectors. These findings highlight an urgent need for more robust adversarial training in skill detection frameworks to secure the expanding ecosystem of autonomous agents.
Pretext: Defeating Malicious Skill Detection Frameworks for AI Agents
arXiv:2609.39607v1 Announce Type: cross Abstract: Skills extend an agent's capabilities by injecting instructions and information into the context, and are widely used by agents such as OpenClaw and Claude Code. Prior work shows third-party marketplaces host malicious skills that give attackers direct influence over the victim's agent. The emerging defense scans skills before installation, pairing deterministic static checks with an LLM-based semantic judge, as in NVIDIA's SkillSpector. We show that such defenses fall to an attacker who knows the detector. Our white-box LLM attacker, Pretext, iteratively crafts skills that evade detection while still delivering the payload and performing the benign task: moving the payload from code into natural language leaves static analysis inert, while framing it as the skill's legitimate purpose and splitting instructions across files keeps the LLM stage below its blocking threshold. Across three open-source models, Pretext achieves up to 97\% and 77\% against a frozen detector and a co-adaptive one, respectively, revealing major gaps in current skill scanners.
Abstract:Skills extend an agent's capabilities by injecting instructions and information into the context, and are widely used by agents such as OpenClaw and Claude Code. Prior work shows third-party marketplaces host malicious skills that give attackers direct influence over the victim's agent. The emerging defense scans skills before installation, pairing deterministic static checks with an LLM-based semantic judge, as in NVIDIA's SkillSpector. We show that such defenses fall to an attacker who knows the detector. Our white-box LLM attacker, Pretext, iteratively crafts skills that evade detection while still delivering the payload and performing the benign task: moving the payload from code into natural language leaves static analysis inert, while framing it as the skill's legitimate purpose and splitting instructions across files keeps the LLM stage below its blocking threshold. Across three open-source models, Pretext achieves up to 97\% and 77\% against a frozen detector and a co-adaptive one, respectively, revealing major gaps in current skill scanners.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2609.39607 [cs.CR]
(or arXiv:2609.39607v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.39607 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 254 cuvinte
Subiecte conexe
SKILLLITE: Evidence-Guided Malicious Skill Auditing with Compact LLMs
arXiv · 30 sept. 2026
[AINews] Reality Checks on AI News (Yegge shuts down Gas Town, Databricks’ +60% Astra cost)
Latent Space · 17 sept. 2026
Hiding in Plain Sight: Decoupling Pretext from Actuation for Skill Poisoning in LLM Agents
arXiv · 1 oct. 2026
Friendly Fire: Hijacking Defensive Cyber AI Agents for Remote Code Execution
AI Now Institute · 8 iul. 2026