Poisoned skills: jailbreaks spread through Agent Markdown files

The researchers demonstrated an attack that spreads jailbreaks through Agent Markdown skill files; the average attack success rate across seven open-weight models rose from 0.5% to 45%, reaching 68.9% on an individual model. The experiment built a LangChain question-answering Agent whose system prompt is assembled from user-supplied Markdown files, with a payload combining persona manipulation and a GPTFUZZER-based attack, and evaluated it with 270 prohibited questions spanning nine categories of harm. Under a benign system prompt, the models almost entirely refused, with an average attack success rate of only 0.5%; after injecting the skill file, it rose to 45%. Both obfuscation strategies—an invisible payload based on zero-width characters and a phonetic payload based on grapheme-to-phoneme conversion—did not exceed plaintext injection, and the phonetic variant instead lowered the average success rate to 30%. The authors point out that Markdown skill files are an understudied Agent attack surface, and that vulnerability to configuration-type jailbreaks depends more on the underlying model than on the obfuscation technique.