MetaCascade: Attacking agent skills with metadata poisoning alone
Start here
Researchers from the University of Electronic Science and Technology of China propose MetaCascade, an end-to-end poisoning framework that, by only tampering with agent skill metadata, allows the same malicious skill to enter the candidate set and be selected by the agent throughout retrieval and final selection. The framework first uses capability-based multi-view candidate generation to preserve the original skill's functionality, then iteratively optimizes malicious metadata using task and black-box competitive feedback; the attacker only needs to download publicly released skills, replace their metadata, and re-upload. Across four skill libraries and two types of agents, Hermes and OpenClaw, the average attack success rate without defenses is 74.24%.
Generated by AI from reports · Updated 29 days ago
Attention and developments
Attention, hourly
Now 39, 0% in 24 hours·Peak 39 (Nov 6 04:00)
Related research
This event's paper
- MetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoning
arXiv · 2026-10-10 · Deep reading
Progress timeline
- arXiv: Adversarial Attacks, Backdoors & PoisoningSelectedMetaCascade: End-to-End Attacks on Agent Skills via Metadata-Only Poisoning
Researchers from the University of Electronic Science and Technology of China propose MetaCascade, an end-to-end poisoning framework that only tampers with Agent skill metadata, allowing the same malicious skill to enter the candidate set and be selected by the Agent throughout retrieval and final selection. The framework first uses capability-based multi-view candidate generation to preserve the original skill functionality, then iteratively optimizes malicious metadata using task and black-box competitive feedback; the attacker only needs to download publicly released skills, replace their metadata, and re-upload them. Across four skill libraries and two types of Agents, Hermes and OpenClaw, the average attack success rate without defenses is 74.24%, 35.53 percentage points higher than the strongest baseline; under four defense settings, the average is 63.33%, 34.65 percentage points higher than the strongest baseline, and it remains 54.65% under SkillScan, which has the strongest limiting effect. The average Hit@1 reaches 49.75%, and generating one malicious metadata consumes an average of 32.57 LLM calls and 121,080 tokens.