Strong AI agent skills copied by watching weaker ones fail
AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing
Cryptography and SecurityArtificial Intelligence
Summary
This paper shows that smarter AI agents can have their problem-solving abilities copied by weaker AI agents just by observing differences in how they perform tasks. The authors find that copying obvious skills alone is not enough; watching what behaviors are missing helps the weaker agent learn deeper problem-solving methods. They created a new method called AgentLeak that helps a weaker agent get much better at tasks by learning from these execution differences without changing its core model. This reveals a new way AI systems might leak valuable secrets, even if their obvious skills are kept hidden.
What this means in practice
- •For ai security engineers: Detect and mitigate risks where weaker AI agents might learn proprietary capabilities by monitoring execution behaviors.
- •For enterprise ai developers: Enhance weaker AI agents by automatically incorporating critical procedural behaviors observed from stronger proprietary agents without changing model architecture.$Commercial implications: This paper enables products that improve lower-capability AI agents by copying advanced behaviors, helping businesses leverage expensive proprietary AI capabilities more broadly.
Authors
Xiaoting Lyu, Yuhong Wu, Yufei Han, Shichang Liu, Liang Zhang, Bin Wang, Bin Wang, Xiaobo Ma, Wei Wang
Abstract
Large language model (LLM) agents increasingly achieve long-horizon tasks by combining foundation models with explicit skills and implicit procedural knowledge acquired through execution. The resulting task-solving capabilities have become valuable proprietary assets, raising a new security question: can a substantially weaker attacker-controlled agent acquire the capabilities of a stronger proprietary agent through limited black-box interaction? Existing skill-stealing attacks recover explicit skill artifacts, yet we show that artifact leakage does not necessarily transfer capability: a weaker agent may possess the same skills but still fail because it lacks procedural behaviors implicitly realized by the stronger agent. Our key insight is that the skill execution gap itself forms a leakage surface, where missing behaviors are exposed through observable differences between successful victim executions and failed attacker executions. Based on this, we present AgentLeak, a black-box capability-cloning attack that identifies capability-critical behaviors from these execution differences and incorporates them into attacker-side skills, while keeping the attacker's model, harness, and tools unchanged. Across 20 task scenarios comprising 600 instances, diverse agent systems, and multiple backbone models, AgentLeak improves task pass rates by over 40% compared with direct skill reuse and recovers more than 80% of the victim--attacker capability gap. Our findings reveal a confidentiality risk in LLM agents: protecting explicit artifacts alone is insufficient, as observable execution behavior can leak the procedural knowledge required to reconstruct proprietary task-solving capabilities in low-capability and attacker-controlled agents.