Dynamic Malicious Skills in Agentic AI
This work identifies and mitigates a new attack surface in agentic AI systems, which is critical for developers and users deploying such systems in security-sensitive contexts.
The paper demonstrates that malicious instructions embedded in natural-language documentation can induce agentic AI systems to dynamically inject malicious logic into benign skills during execution, achieving non-trivial success rates across frameworks like OpenHands and Claude Code. It proposes a kernel-enforced read-only mount defense that blocks this attack while preserving benign skill functionality.
Skills are a key enabling component of agentic AI. While they enhance agents' capabilities, they also introduce new attack surfaces. In this work, we investigate one such attack surface by demonstrating dynamic malicious skills. By embedding malicious instructions in natural-language documentation (e.g., SKILL.md), an attacker can induce an agent to dynamically inject malicious logic into an otherwise benign skill during execution. We evaluate this attack across agentic frameworks such as OpenHands and Claude Code, showing that dynamic malicious skills can successfully introduce a range of malicious behaviors at runtime with non-trivial success rates. To mitigate this vulnerability, we propose a system-level defense that prevents dynamic modification of skills using operating system kernel-enforced read-only mounts. Our evaluation demonstrates that this defense effectively blocks dynamic malicious skills while preserving the functionality of benign skills.