Llm agents vulnerable to attacker skill chains causing harmful actions
Chaining Skills to Hijack LLM Agents
Cryptography and SecurityArtificial Intelligence
Summary
LLM agents complete tasks by using different skills in a chain. The authors show that attackers can trick these agents by linking skills that pass false approvals, making the agent do harmful actions without the user's real consent. They created APEX, a way to build such attack chains, and tested it on many models with high success. They also tried a defense to have the agent check if skill outputs matched the user's request, which reduced but did not eliminate attacks, and sometimes hurt normal task success.
What this means in practice
- •For security engineers: Assess and improve defense methods against attacker-controlled skill chains in LLM agents to prevent unauthorized actions.
- •For ai platform developers: Design LLM agent systems to detect and handle malicious skill handoffs that carry false user approvals.
Authors
Tian Dong, Zixuan Ma, Haodong Zhao, Huaien Zhang, Shaofeng Li, Hao Chen
Abstract
LLM agents use skills to improve performance on specialized tasks. To complete a user request, an agent may invoke several skills in sequence, allowing information produced under one skill to guide the next. Because skills may come from open-source repositories, this handoff can also carry attacker-controlled claims into later decisions. In this paper, we introduce APEX, which constructs and refines adversarial skill chains tailored to a user task and an attacker-selected action. The key insight is that an agent-written record of genuine task progress can carry a false claim of user approval across skills: an upstream skill induces the agent to create the record, and a downstream skill uses it to direct the attacker-selected action. Across four targeted-action families and six models on SkillsBench, the chains induce the selected action in 512 of 690 attempts (74.2%). On GPT-5.4, the full chain succeeds in 84.3% of attempts, compared with 17.4% when the workflow is merged into one skill. We further evaluate a prompting defense that asks the agent to check skill-produced files against the original request. On GPT-5.4, it lowers targeted-action success from 84.3% to 59.1%, while the verifier test-pass rate across 72 benign native-skill tasks falls from 86.7% to 56.3%. These results highlight the need for defenses that prevent attacker-directed actions while preserving legitimate task performance.