StealthyPoison poisons third-party skills to mislead LLM agents
Original title: StealthyPoison: Manipulating LLM Agent Behavior through Procedural Poisoning of Third-Party Skills
Payloads built with one surrogate transferred unchanged to three held-out models and succeeded in a Claude Code workflow using Opus 4.8.
StealthyPoison alters decision-critical rules in public third-party skills so LLM agents produce wrong outcomes while the skill still looks functional. The attack synthesizes requests, runs the clean skill on a surrogate agent, and iteratively refines payloads without seeing real user requests or answers. Retrieval metadata is padded with generated request descriptions to raise selection odds. On 566 skills and 5,244 requests, top-1 poisoned-skill placement rose 13.6% versus HotFlip and GCG, and most payloads evaded SkillSpector and GPT-5.4-mini.
Unconfirmed: Attack success and evasion rates are the authors' evaluation, not confirmed in-the-wild incidents.
- Evaluation covered more than 26,000 registry entries.
- Top-1 placement improved 13.6% relative to HotFlip and GCG.
- Most payloads evaded SkillSpector and GPT-5.4-mini.
- The attack does not need the user's real requests or ground-truth answers.
Impact: incorrect task outcomes from poisoned agent skills
| Product | Affected |
|---|---|
| third-party LLM agent skills | — |
- Products
- Claude CodeSkillSpector
- AI models
- Opus 4.8GPT-5.4-mini
From the original article
1 min read at arxiv.orgLLM agents increasingly retrieve third-party skills from public registries and follow their procedures to complete user tasks. This reliance allows attackers to manipulate agent behavior by poisoning the skills. However, overtly malicious instructions can provide explicit signals for detection.
By Jingfen Qiao · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.