Dynamic Malicious Skills in AI Agents

Researchers demonstrated a dynamic malicious skill attack against AI agents, in which the attacker embeds malicious instructions in natural-language documents such as SKILL.md, inducing the agent to inject malicious logic into an otherwise harmless skill at execution time. The attack was evaluated on agent frameworks such as OpenHands and Claude Code, and can introduce a series of malicious behaviors at runtime with a non-trivial success rate. To mitigate this vulnerability, the authors propose a system-level defense that uses read-only mounts enforced by the operating system kernel to prevent skills from being dynamically modified; evaluation shows that this defense blocks such attacks while preserving the functionality of normal skills.