Agent Files Turn Hostile
Submitted on 9 October and listed in cs.CR on 12 October, SkillRelay tests whether poisoned skills can influence a fresh session through persistent artifacts.
What crosses the reset
The attacker controls several pre-deployed skills, but not the task, policy, model or scaffold. One skill seeds an artifact; another reuses it later. Tests cover instruction, data-boundary and evidence attacks.
What the runs showed
In 1,890 runs, 53.0 per cent completed both the user task and attacker objective.
SkillRelayGuard cut attack success from 69.5 to 10.9 per cent across one configuration per scaffold; the agent still decides.
Docker tests cannot cover every workflow. Defence used one configuration per scaffold; the ablation covered Codex CLI only. No live campaign was studied.
A practical handoff policy
BlackTree recommends:
- Require a handoff manifest. Record the package version, task identifier, integrity digest and declared consumer.
- Revalidate before reuse. Compare authority, data scope, consequential claims and the planned operation with the current request and original records.
- Enforce local policy. Require a block or human approval for high-impact mismatches instead of relying on advisory text.
- Separate trust zones. Reset or isolate working state across users, projects or third-party skill boundaries.
- Test the relay. Run paired-session adversarial cases and score both task completion and security outcome.
Treat the handoff as a small change request. Its review record should name the consumer, approver and expiry, plus where the accepted decision is logged. If a later task lacks that record, resolve the missing ownership before continuing.
Sources
- SkillRelay paper, version 1, 9 October 2026.
- SkillRelay abstract and submission record, submitted 9 October 2026.
- arXiv cs.CR new listing, observed 12 October 2026.
- SkillRelay benchmark and implementation repository, observed 12 October 2026.
