Defenses & Enablers For Skill Injection Attacks on Terminal Based Agents
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2026
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866916072151580672 |
|---|---|
| author | Fujinuma, Yoshinari Gangal, Varun Rebedea, Traian Sreedhar, Makesh Narasimhan Varshney, Prasoon Qian, Rebecca Kannappan, Anand |
| author_facet | Fujinuma, Yoshinari Gangal, Varun Rebedea, Traian Sreedhar, Makesh Narasimhan Varshney, Prasoon Qian, Rebecca Kannappan, Anand |
| contents | Large language model (LLM) agents increasingly rely on reusable skills i.e. documents describing task-specific procedures. However, this introduces a new attack surface for agents to manage. We study two complementary directions for this threat. First, we evaluate guardian-based defenses: an intermediary LLM agent that acts as a mediator for skill file access (dynamic guardian) or pre-rewrites these files at build time (static guardian). Across three LLM agent families, our guardians cut attack success rate (ASR) by well over half while preserving task utility. Second, we stress test them through attack reframing using four attacks that preserve the malicious instruction but change the phrasing. For non-guardian setup, the reframing pushes the ASR up to 81.4\%, but the dynamic guardian brings it down to 18.6\%, showing that real-time mediation is a robust defense. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2606_01567 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Defenses & Enablers For Skill Injection Attacks on Terminal Based Agents Fujinuma, Yoshinari Gangal, Varun Rebedea, Traian Sreedhar, Makesh Narasimhan Varshney, Prasoon Qian, Rebecca Kannappan, Anand Cryptography and Security Artificial Intelligence Computation and Language Large language model (LLM) agents increasingly rely on reusable skills i.e. documents describing task-specific procedures. However, this introduces a new attack surface for agents to manage. We study two complementary directions for this threat. First, we evaluate guardian-based defenses: an intermediary LLM agent that acts as a mediator for skill file access (dynamic guardian) or pre-rewrites these files at build time (static guardian). Across three LLM agent families, our guardians cut attack success rate (ASR) by well over half while preserving task utility. Second, we stress test them through attack reframing using four attacks that preserve the malicious instruction but change the phrasing. For non-guardian setup, the reframing pushes the ASR up to 81.4\%, but the dynamic guardian brings it down to 18.6\%, showing that real-time mediation is a robust defense. |
| title | Defenses & Enablers For Skill Injection Attacks on Terminal Based Agents |
| topic | Cryptography and Security Artificial Intelligence Computation and Language |
| url | https://arxiv.org/abs/2606.01567 |