Research map / Multi-agent systems and games / LLM agents

Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems

NeurIPS 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces skill cascading attacks, where a malicious objective is split across multiple agent skills so each edit passes per-skill scanning, and builds an automated multi-agent red-teaming framework (SkillCascade) plus a 213-case benchmark (SkillCascade-Bench) showing high attack success and scanner/runtime evasion.

Problem

Skill-based LLM agent ecosystems load third-party skills into a shared context window, but existing safety scanners and runtime defenses analyze skills individually, leaving cross-skill interactions unexamined.

Approach

Distribute a harmful objective across two or more individually benign-looking skill modifications so that only their combined execution causes harm; formalize this with individual stealth, joint harm, and indispensability conditions, and automate generation with a five-agent red-teaming loop validated by a judge and expert annotators.

Key results

• Cascading attacks achieve a global average attack success rate of 89.4% across 3 agent systems and 8 LLM backbones (range 76.5% to 97.1%).
• Per-skill scanners retain stealth rates above 86% on modified skills, with delta never exceeding 4.7 points.
• Runtime defenses show mean defense evasion rate of 88.5% on OpenClaw with GPT-5.4-mini.

Surprising findings

• Static joint-skill scanner shows zero stealth delta, fully blind to cascading modifications.
• Smaller model variants are reliably more vulnerable than their flagship counterparts within each vendor family.

Limitations

• Evaluation runs in realistic sandboxes rather than live deployments, so absolute rates are a stress test.
• Judge Agent is LLM-based and would benefit from complementary human review.
• Real-world incidence of attacker-controlled co-installation remains unknown.

Experimental setup

Datasets: ClawHub skills

Benchmarks: SkillCascade-Bench

Metrics: attack success rate stealth rate defense evasion rate

Baselines: Skill-Scanner SkillScan Skill-Vetter AIG-Scanner SkillProbe DefenseClaw ClawGuard HITL Defense AgentDoG

Builds on: Skill-Vetter Skill-Scanner SkillProbe AgentDojo InjecAgent

Closest papers by meaning

• Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks (NeurIPS 2026 · similarity 0.88)
• Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents (NeurIPS 2026 · similarity 0.88)
• PROTEUS: A Self-Evolving Red Team with Surface Expansion for Agent Skill Ecosystems (NeurIPS 2026 · similarity 0.88)
• Multi-Agent Security Tax: Trading Off Security and Collaboration Capabilities in Multi-Agent Systems (AAAI 2025 · similarity 0.86)
• Unsafer in Many Turns: Benchmarking and Defending Multi-Turn Safety Risks in Tool-Using Agents (ICML 2026 · similarity 0.86)
• AdvEvo-MARL: Shaping Internalized Safety through Adversarial Co-Evolution in Multi-Agent Reinforcement Learning (ICML 2026 · similarity 0.86)