The study tests a trust boundary when an agent translates encoded or encrypted strings found in untrusted skill material into operational instructions. The original PDF text was not fully retrievable during this research, so the case is limited to the authors’ abstract-level measurements and avoids claiming specific model rankings, victim systems or a…
Inspect the ClaimsCase · DiggingBeagle record
Encoded instructions in skill files can be recovered and promoted into agent actions
Ciphered Skill Injection places obfuscated malicious instructions in skill material. Across 139 task pairs and eight models, the authors report attack rates up to 47.5% for Caesar and 40.3% for layered variants in their shortened-skill evaluation.
Scope
Preprint controlled-model measurements as described in the abstract; model-specific attack rates beyond the headline maxima not revalidated in the full paper.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- AI role
- AGAINST AI
Basis and provenance
Only abstract-level attack rates were available in the pinned dossier; model-by-model distributions and complete script effects were not independently checked. The measured outcome is confined to controlled skill inputs. Assessment uses the pinned Claims and source identities; public primary pages were not independently retrievable during this run. Impact remains unrated because field consequence or a comparable scoring rubric is not established.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP7-CIPHER-RATE · CLM-CP7-CIPHER-SETUP · CLM-CP7-CIPHER-DECODE · Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher
At a glance
The underlying model-by-model tables and scanner tests require full-paper reproduction. No actual malicious skill campaign or production victim has been established.
Limits and uncertaintyFull account
The study tests a trust boundary when an agent translates encoded or encrypted strings found in untrusted skill material into operational instructions. The original PDF text was not fully retrievable during this research, so the case is limited to the authors’ abstract-level measurements and avoids claiming specific model rankings, victim systems or a deployed attack. The encoded form may evade basic textual filtering but only an independent execution policy can establish whether decoded content receives authority.
Decoding is not itself an unauthorized side effect. The relevant boundary lies between interpreting encoded task data and converting the result into tool-use instructions, which the available abstract cannot map for every evaluated model.
Claims & evidence
CLM-CP7-CIPHER-RATEThe authors report peak attack success of 47.5% for a Caesar-style variant and 40.3% for a layered variant in their primary shortened-skill condition.supported
Basis: reported finding
- supportsEncrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipherprimary disclosure
Abstract; stated primary shortened-skill findings
CLM-CP7-CIPHER-SETUPThe controlled study embeds encoded task instructions into untrusted skill files and tests Caesar and layered variants across eight language models and 139 injection-task pairs.supported
Basis: reported finding
- supportsEncrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipherprimary disclosure
Abstract; reported experimental design
CLM-CP7-CIPHER-DECODEInstruction recovery and malicious-action success are separate outcomes; successful decoding does not by itself mean the attack succeeded.supported
Basis: reported finding
- supportsEncrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipherprimary disclosure
Abstract; distinction between recovery and attack success
Unknowns and contradictions
- The underlying model-by-model tables and scanner tests require full-paper reproduction.
- No actual malicious skill campaign or production victim has been established.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 150