Agent skill persistence raises security risks and blockchain fixes them
Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition
Cryptography and SecuritySoftware Engineering
Summary
AI agents use skills made up of instructions and data which can leave behind files and settings that stick around for future tasks. This leftover information can be exploited by attackers to trick AI agents in later sessions, causing misbehavior or security problems. The authors studied these 'cross-session' attacks, created a benchmark to test them, and found that many AI models are vulnerable. They designed a defense system called SkillRelayGuard that helps AI agents check and track these persistent artifacts, greatly lowering attack success while improving normal task completion.
What this means in practice
- •For ai system developers: Build safer AI agents by detecting and preventing attacks through leftover data between skill uses.
- •For cloud automation engineers: Secure automated task pipelines that reuse AI skills by validating and isolating persistent artifacts to avoid cascading compromises.
Authors
Dianshu Liao, Shidong Pan, Guangdong Bai, Zhenchang Xing, Xiaoyu Sun
Abstract
Agent skills extend the capabilities of AI agents by bundling instructions, code, and resources into reusable packages. During skill execution, agents may produce or modify artifacts, such as files, configurations, and cached data, that are reused by other skills in later sessions. Since these artifacts can persist across sessions and later be accessed by other skills, they introduce a new attack surface that can be exploited to influence subsequent executions. However, the security risks arising from such cross-session skill interactions remain largely unexplored. In this work, we investigate cross-session composition attacks in skill-based AI agents and develop a runtime defense against them. Specifically, we characterize three attack mechanisms, namely Instruction Propagation (IP), Data Boundary Violation (DBV), and Evidence Poisoning (EP), through which malicious effects propagate across skill executions via persistent artifacts. To evaluate whether existing agents can resist these attacks while completing legitimate tasks, we construct SkillRelayBench, a benchmark of 270 adversarial cases drawn from 30 cross-session skill-composition scenarios across ten domains. Our evaluation of seven models across Codex CLI, Gemini CLI, and Claude Code reveals attack success rates (ASR) ranging from 46.7% to 77.4% and attack chain success rates (ACSR) ranging from 35.6% to 61.1%. Successful attack chains cover all five target security consequence categories, highlighting the broad impact of these attacks. To mitigate these risks, we propose SkillRelayGuard, which restores artifact provenance context and provides pre-execution advisory review while leaving the final execution decision to the agent. Evaluation across three agent settings shows that SkillRelayGuard reduces overall ASR from 69.5% to 10.9% and ACSR from 54.8% to 10.0%, while increasing legitimate task completion from 79.6% to 87.5%.