Skill injections must survive router selection to succeed in AI attacks
Surviving the Router: Optimizing Skill Injections for Retrieval and Execution
Cryptography and SecurityMachine Learning
Summary
AI systems use many little tools called skills to get tasks done, and a router picks which skill to use. Earlier studies mostly looked at cases where a bad skill is already chosen, but this paper shows that such attacks fail most of the time when the router picks from many skills. The authors created a new method named CORSA that helps bad skills get picked more often and then carry out their attack better. They tested this method and found it works well across different routers and AI models, while still appearing natural to users.
What this means in practice
- •For ai security teams: Evaluate and improve defenses against skill injection attacks that exploit multi-skill routing in AI agents.
- •For software developers: Design AI systems with better skill retrieval mechanisms by understanding how adversarial skill injections compete during routing.
Authors
Haneen Najjar, Luca Scionis, Haritz Puerto, Sahar Abdelnabi
Abstract
AI agents increasingly rely on modular third-party "skills" that are dynamically selected by skill routers to execute complex tasks. While recent studies highlight the threat of prompt injections embedded in these skills, existing evaluations often assume settings where the malicious skill is already selected for execution. We show that this assumption can substantially overestimate attack success. In realistic multi-skill environments, injected skills must first compete for retrieval, reducing the effective attack success rate (ASR) of existing injections by 87-97%. To address this limitation, we introduce CORSA (Cluster Optimization for Router-Aware Skill Attacks), a router-aware attack that optimizes skill injections for both retrieval and execution across clusters of related tasks. We evaluate skill injection attacks under router-managed multi-skill settings by extending the benchmark introduced by SkillRouter with eight malicious payload categories. CORSA uses successive optimization stages to first improve retrieval and then optimize end-to-end attack success, while we evaluate user utility and injection naturalism separately. Our experiments show that CORSA substantially improves both retrieval and end-to-end attack success over existing skill injections while preserving user utility, and that the resulting attacks transfer across different router architectures and LLM backbones.