Surviving the Router: Optimizing Skill Injections for Retrieval and Execution
CORSA optimizes malicious agent-skill injections so they survive router retrieval and still execute across models.
Researchers find that prompt injections in third-party agent skills are far less effective once a router must retrieve the malicious skill, cutting prior attack success by 87–97%. They introduce CORSA, which optimizes injections across related task clusters for both retrieval and execution. On an extended SkillRouter benchmark with eight payload categories, CORSA improves retrieval and end-to-end success while preserving user utility. The attacks transfer across different router architectures and LLM backbones.
- Existing skill injections lose 87-97% success when retrieval competition is required.
- CORSA optimizes injections first for retrieval, then for end-to-end execution.
- Tests cover eight malicious payload categories on an extended SkillRouter benchmark.
- Resulting attacks transfer across router architectures and LLM backbones.
From the original article
1 min read at arxiv.orgAI agents increasingly rely on modular third-party "skills" that are dynamically selected by skill routers to execute complex tasks. While recent studies highlight the threat of prompt injections embedded in these skills, existing evaluations often assume settings where the malicious skill is already selected for execution. We show that this assumption can substantially overestimate attack success.
By Haneen Najjar · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.