Encrypted instructions in agents’ ‘skills’: up to 47.5 per cent of attacks successful, and scanners that detect almost nothing

Researchers hide malicious commands, encoded using the Caesar cipher, within third-party skill files: agents then decrypt them and execute them.

Agents based on LLMs are increasingly enriched with "skills", skills files published by third parties. A team including Pin-Yu Chen and Chia-Mu Yu describes an attack called Ciphered Skill Injection: instead of writing a malicious instruction in plain text, the attacker encodes it (Caesar's cipher or multi-layered variant) in the file, relying on the model's ability to decode it and then treat it as a legitimate instruction.

Tested on eight models and 139 combinations of injections and tasks, the method achieves up to 47.5% success with the simple variant and 40.3% with the layered version, in a scenario where skills are shortened. The authors note that decoding the message is not always enough to make the attack succeed, and that stacking the encoding layers has effects that vary from one model to another.

The most worrying point is defense: the skills scanners evaluated rarely flag booby-trapped files. For researchers, the risk lies in the fact that unreliable content, once decoded, is promoted to the rank of executable instruction.