Agent Attacks Survive Session Resets
Poisoned agent skills can carry an attack into a later conversation through saved work, even after the visible history has been reset. SkillRelay demonstrated this in controlled tests, not a live campaign.
A poisoned skill induced the agent to save an artefact; another steered its reuse. Tasks and policy stayed fixed, without between-session edits. Across 1,890 runs, 53.0 per cent achieved both user and attacker objectives.
SkillRelayGuard reduced attack success from 69.5 to 10.9 per cent across three settings, but the agent retained the final decision. The Docker tests used one configuration per scaffold without repeated trials, limiting generalisation.
Practical implications
The supplied software is not a global protection plugin. Its operation review covers the submission adapter and receiver fallback, not arbitrary local file changes or SQLite publication. The authors warn against installing attack skills in a personal agent environment.
Check the intended recipient and delivered material against the original request. Keep that result tied to the tested route: an unreviewed path needs its own assessment.
Sources
- SkillRelay paper, version 1, 9 October 2026.
- Submission record, 9 October 2026.
- Public implementation, checked 14 October 2026.
