Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition
Cross-session skill attacks succeed on coding agents at up to 77% ASR; SkillRelayGuard cuts that to 11%.
The paper studies cross-session attacks in skill-based AI agents, where persistent files, configurations, and cached data can influence later skills. It defines Instruction Propagation, Data Boundary Violation, and Evidence Poisoning, and introduces SkillRelayBench with 270 adversarial cases from 30 scenarios across ten domains. Across seven models in Codex CLI, Gemini CLI, and Claude Code, attack success rates range from 46.7% to 77.4% and chain success from 35.6% to 61.1%. SkillRelayGuard, which restores artifact provenance and adds pre-execution advisory review, reduces overall ASR from 69.5% to 10.9% and ACSR from 54.8% to 10.0%, while legitimate completion rises from 79.6% to 87.5%.
- Attacks use instruction propagation, data boundary violation, and evidence poisoning.
- SkillRelayBench contains 270 cases from 30 scenarios across ten domains.
- ASR is 46.7–77.4% on Codex CLI, Gemini CLI, and Claude Code.
- SkillRelayGuard cuts overall ASR from 69.5% to 10.9% and ACSR to 10.0%.
- Legitimate task completion rises from 79.6% to 87.5%.
Full article269 words · extracted from arxiv.org · click to collapse
Agent skills extend the capabilities of AI agents by bundling instructions, code, and resources into reusable packages. During skill execution, agents may produce or modify artifacts, such as files, configurations, and cached data, that are reused by other skills in later sessions. Since these artifacts can persist across sessions and later be accessed by other skills, they introduce a new attack surface that can be exploited to influence subsequent executions. However, the security risks arising from such cross-session skill interactions remain largely unexplored. In this work, we investigate cross-session composition attacks in skill-based AI agents and develop a runtime defense against them. Specifically, we characterize three attack mechanisms, namely Instruction Propagation (IP), Data Boundary Violation (DBV), and Evidence Poisoning (EP), through which malicious effects propagate across skill executions via persistent artifacts. To evaluate whether existing agents can resist these attacks while completing legitimate tasks, we construct SkillRelayBench, a benchmark of 270 adversarial cases drawn from 30 cross-session skill-composition scenarios across ten domains. Our evaluation of seven models across Codex CLI, Gemini CLI, and Claude Code reveals attack success rates (ASR) ranging from 46.7% to 77.4% and attack chain success rates (ACSR) ranging from 35.6% to 61.1%. Successful attack chains cover all five target security consequence categories, highlighting the broad impact of these attacks. To mitigate these risks, we propose SkillRelayGuard, which restores artifact provenance context and provides pre-execution advisory review while leaving the final execution decision to the agent. Evaluation across three agent settings shows that SkillRelayGuard reduces overall ASR from 69.5% to 10.9% and ACSR from 54.8% to 10.0%, while increasing legitimate task completion from 79.6% to 87.5%.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.13227