Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher

Summary

Researchers introduce Ciphered Skill Injection (CSI), which hides malicious instructions in encoded form inside third-party skill files so that LLM agents decode and follow them. Across eight models and 139 injection-task pairs, the Caesar and layered variants reach attack success rates of up to 47.5% and 40.3% in the primary setting with shortened skills. The tested skill scanners rarely flag the injected skills.

Topics

• AI agents

Related items

• MediumVisual Studio Copilot and SSMS Remote Code Execution (CVE-2026-103572)Similar attack · Embrace The Red
• HighCVE-2026-110206: Roo Code command approval bypass in parseCommandLine() via command substitutionSimilar attack · NVD/CVE Database
• HighCVE-2026-110205: Roo Code command approval bypass through parseCommandLine() command substitutionSimilar attack · NVD/CVE Database
• HighCVE-2026-110204: Roo Code command approval bypass through parseCommandLine substitutionsSimilar attack · NVD/CVE Database
• HighCVE-2026-110203: Roo Code command approval bypass via quote-masking regexSimilar attack · NVD/CVE Database