If AI agents know how to decrypt, encrypted skills could become a new security exploit

The researchers propose the Ciphered Skill Injection (CSI) attack, which embeds encoded, hidden malicious instructions into third-party skill files to induce LLM agents to decode and execute them. The experiments cover eight models and 139 injection task pairs, and measure instruction recovery separately from attack success; under the main setting with shortened skill files, the Caesar variant and the layered variant reach attack success rates of up to 47.5% and 40.3%, respectively. The results show that successful decoding does not necessarily lead to attack success, that the effect of layered encoding varies by model, and that the tested skill scanners rarely flag injected skills.