An adversary augments an agent skill pool with capability-compatible skills. Legitimate skill selection then assembles an unsafe read, transform or write sequence that crosses the user’s policy despite unchanged basic model privileges. Across 288 tasks, five models and three agent harnesses, CoSA raises policy-violation outcomes from 1,513/4,320 (35.02%)…
Inspect the ClaimsCase · DiggingBeagle record
CoSA induced unsafe agent behavior by adding few individually plausible skills
CoSA demonstrates the security effect of cross-skill composition, rather than malicious code inside every skill.
Scope
The modelled tasks span recruiting, finance, IT and business operations. The results do not establish new privileges in deployed services or a corresponding live-victim count.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The study holds model and task budgets fixed and augments skill pools by at most five percent. It measures 4,320 task runs and separately evaluates CoSA-Guard on 360 recruiting-task runs. Both attack and defense effects are benchmark outcomes, not confirmed user compromises. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-007-A · CLM-CP22-007-B · CLM-ENRICH-20261028-005 · CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems
At a glance
Defense behavior against skill providers that adapt after deployment and novel tool chains is not established.
Limits and uncertaintyFull account
An adversary augments an agent skill pool with capability-compatible skills. Legitimate skill selection then assembles an unsafe read, transform or write sequence that crosses the user’s policy despite unchanged basic model privileges.
Across 288 tasks, five models and three agent harnesses, CoSA raises policy-violation outcomes from 1,513/4,320 (35.02%) to 2,525/4,320 (58.45%). The study caps additions at 5% of the original skill pool, so the 23.43-percentage-point increase measures augmentation under its benchmark conditions. Primary evidence.
The modelled tasks span recruiting, finance, IT and business operations. The results do not establish new privileges in deployed services or a corresponding live-victim count.
Evaluate the complete planned capability flow and enforce effect-level rules on private data access, external writes and irreversible mutations.
Claims & evidence
CLM-CP22-007-AAcross 288 tasks, five models and three agent harnesses, CoSA raises policy-violation outcomes from 1,513/4,320 (35.02%) to 2,525/4,320 (58.45%).supported
Basis: reported finding
- supportsCoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystemsprimary disclosure
Abstract; Section 4.2, Table 2
CLM-CP22-007-BThe study caps additions at 5% of the original skill pool, so the 23.43-percentage-point increase measures augmentation under its benchmark conditions.supported
Basis: reported finding
- supportsCoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystemsprimary disclosure
Section 4.2, baseline versus augmented conditions
CLM-ENRICH-20261028-005In a separate 360-run recruiting test, CoSA-Guard reduced reported attack success from 235/360 (65.28%) to 24/360 (6.67%), while falsely blocking 12/360 benign control runs.supported
Basis: reported finding
- supportsCoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystemsprimary disclosure
Section 4.4 Defense Evaluation, security and utility outcomes
Controls and mitigations
- Evaluate the complete planned capability flow and enforce effect-level rules on private data access, external writes and irreversible mutations.
Unknowns and contradictions
- Defense behavior against skill providers that adapt after deployment and novel tool chains is not established.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199