Markdown skill files can propagate jailbreak attacks

1. 23:29
   arXiv: Jailbreaks, Prompt Injection, Poisoning & Defenses

   Poisoned skills: jailbreaks spread through Agent Markdown files

   The researchers demonstrated an attack that spreads jailbreaks through Agent Markdown skill files; the average attack success rate across seven open-weight models rose from 0.5% to 45%, reaching 68.9% on an individual model. The experiment built a LangChain question-answering Agent whose system prompt is assembled from user-supplied Markdown files, with a payload combining persona manipulation and a GPTFUZZER-based attack, and evaluated it with 270 prohibited questions spanning nine categories of harm. Under a benign system prompt, the models almost entirely refused, with an average attack success rate of only 0.5%; after injecting the skill file, it rose to 45%. Both obfuscation strategies—an invisible payload based on zero-width characters and a phonetic payload based on grapheme-to-phoneme conversion—did not exceed plaintext injection, and the phonetic variant instead lowered the average success rate to 30%. The authors point out that Markdown skill files are an understudied Agent attack surface, and that vulnerability to configuration-type jailbreaks depends more on the underlying model than on the obfuscation technique.

Current attention 36·Peak in the comparable period 36 (Nov 6 04:00)·Change over the comparable past 24 hours 0%