StealthyPoison manipulates LLM Agent behavior through programmatic poisoning

1. 18:05
   arXiv: Adversarial Attacks, Backdoors & PoisoningSelected

   StealthyPoison: programmatic poisoning of third-party skills to manipulate LLM agent behavior

   Researchers propose StealthyPoison, a poisoning attack that manipulates the task outcomes of LLM agents by tampering with decision-influencing rules in third-party skills. When real user requests and ground-truth answers are unavailable, the method uses synthetic requests and the execution outputs of clean skills to generate pseudo-references, iteratively modifies formulas, thresholds or judgment logic in the skills, and augments retrieval metadata to increase the probability of being selected. In an evaluation with 566 skills, 5,244 requests and more than 26,000 registry entries, the proportion of poisoned skills entering top-1 improved by 13.6% relative to HotFlip and GCG; when the frozen payloads were transferred to three models, they achieved an oracle execution attack success rate of 31.0%–31.9%, and the end-to-end attack success rate in an Opus 4.8-driven Claude Code workflow was 10.1%. Most payloads were not detected by SkillSpector and GPT-5.4-mini, and the authors accordingly argue that defenses need to verify the behavioral correctness of skill program rules rather than relying only on pre-execution content scanning.

Current attention 42·Peak in the comparable period 44 (Nov 10 21:00)·Change over the comparable past 24 hours -1%