CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems

Summary

CoSA, or the Conflict of Skills Attack, shows that LLM agents can break policy when individually safe Agent Skills are composed, because artifacts or authorizations from one Skill are reused downstream without their original restrictions. Adding locally admitted Skills to an existing pool, capped at 5% of each pool, raised the policy-violation rate across five LLMs and three agent harnesses from 35.02% to 58.45%. The authors also propose a harness-level guard that checks information flow and authorization before consequential actions, reducing violations on OpenClaw recruiting tasks from 65.28% to 6.67%.

Mitigation

A lightweight harness-level guard that checks information flow and authorization before consequential actions. On OpenClaw recruiting tasks across five models, it reduces violations from 65.28% to 6.67%, while policy-compliant task completion on matched benign controls changes from 66.67% to 65.00%.

Related items

• MediumIn-the-Wild Attack Abuses AI Agents' Trust in MarkdownSimilar attack · Dark Reading
• HighCVE-2026-115924: Rembg unauthenticated file disclosure through public /api/remove endpointSimilar attack · NVD/CVE Database
• HighCVE-2026-115915: vLLM image loading flaw allows EPS payload dispatchSimilar attack · NVD/CVE Database
• LowThe RealReal won’t let AI agents hog designer clothingSimilar attack · The Verge (AI)
• HighCVE-2026-115912: vLLM arbitrary Python execution via forged shared-memory multimodal dataSimilar attack · NVD/CVE Database