Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents
2026-08-12 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors studied how large language model (LLM) agents use third-party skills to complete tasks and discovered a new type of attack called Convergent Detour Hijacking (CDH). This attack tricks the system into choosing an extra, unnecessary skill that makes the task take much longer and use more resources, even though the right answer is still produced. They tested CDH on many tasks with different LLMs and found that it often successfully inserted the distracting skill, causing significant delays and extra processing without failing the task. This shows that even when the final result is correct, the process can be inefficient or manipulated.
Large Language ModelsLLM AgentsThird-party SkillsSkill SelectionTask PlanningConvergent Detour HijackingRuntime-independent AttackResource AmplificationTask CompletionExecution Time
Authors
Junliang Liu, Ruoyu Li, Wenxin Tang, Jingyu Xiao, Zhenyu Liu, Jingheng Xu, Laizhong Cui
Abstract
LLM agents increasingly rely on third-party skills, using natural-language descriptions for selection and instruction bodies for planning. This progressive-disclosure design exposes two sequential control points to untrusted publishers: a static skill may steer an otherwise correct task onto an unnecessarily costly trajectory. Prior work studies selection manipulation, malicious skill instructions, and tool-chain resource amplification largely separately, leaving their end-to-end composition unclear. We introduce Convergent Detour Hijacking (CDH), a text-only, runtime-independent attack that couples these stages. Under shared semantic cover, a description establishes relevance during selection, while an aligned body reuses that rationale to fabricate plausible dependencies during planning. CDH attracts an attacker-controlled coordinator alongside legitimate skills, recruits unnecessary benign skills into a bounded detour, and then re-enters the original route to preserve task completion. We evaluate it across multiple LLM backends and 491 held-out tasks under single-task and multi-turn conditions. On DeepSeek-V4-Pro, the matched coordinator is selected in 80.02% of tasks; among coordinator-hit runs that complete tasks, token consumption and end-to-end execution time increase by 66.91% and 92.45%, respectively, while aggregate task completion remains comparable. Thus, correct outcomes do not guarantee trajectory integrity or cost safety.