New study finds AI agents can be manipulated by combining harmless-looking skills

Skill cascading attacks split a malicious goal across several add-on modules for AI agents so that each piece looks harmless, then let their combined execution cause real damage, according to a new paper posted to arXiv. A skill, in this context, is a packaged bundle of instructions, scripts and reference files that an agent loads to handle a specific task, such as reviewing a prescription or drafting a report.

The paper, by Zihao Zhu, Siwei Lyu, Adel Bibi and Baoyuan Wu, argues that most existing security work on these systems checks skills one at a time, missing risks that only appear when skills interact. The authors illustrate the problem with a prescription-review pipeline built from three skills. The first quietly weakens signals that a patient had recently stopped taking a medication. The second downgrades the severity rating of any drug interaction linked to that medication. The third suppresses low-priority alerts from the final summary. None of the three changes looks dangerous in isolation, but chained together they erase a severe drug-interaction warning before it reaches a physician, the paper says.

Testing across agent systems

To study the problem systematically, the authors built SkillCascade, an automated framework that uses multiple AI agents to generate and validate cascading attacks. From it they produced SkillCascade-Bench, a benchmark of 213 validated test cases spanning multiple domains. They ran the benchmark against several agent systems, including OpenClaw, Claude Code and Codex, paired with different underlying language models.

According to the paper, the cascaded attacks reliably produced harmful behavior across these systems, and did so while evading tools meant to catch problems: per-skill scanners that vet individual modules before they load, and runtime monitors that watch an agent’s behavior as it executes. Because each contributing skill passes inspection on its own, the authors say, the combined harm only becomes visible once the full chain runs.

The paper frames this as a gap between component-level integrity, whether each individual skill is safe, and system-level safety, whether the agent’s overall behavior is safe once skills are combined. It calls for defenses that reason about interactions across skills rather than screening them one by one.

The paper is a preprint and has not been through formal peer review. It does not name commercial skill marketplaces found to contain real-world cascading attacks; the test cases were generated and validated through the authors’ own red-teaming framework, and the abstract does not propose a specific defense mechanism, only that one is needed. What to watch next is whether developers of skill-based agent platforms, including the systems named in the paper, respond with tools that inspect combinations of skills rather than single modules, and whether SkillCascade-Bench becomes a reference dataset other researchers test their own agent systems against.