研究发现：加密技能可被用于攻击 AI 智能体，Caesar 编码注入成功率最高达 47.5%

Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher

AI 导读

研究者提出 Ciphered Skill Injection（CSI），将恶意指令编码后嵌入技能文件，诱导 LLM 智能体解码并执行。在八个模型、139 对注入任务上测试 Caesar 及分层变体，缩短技能的主设置下攻击成功率最高分别为 47.5% 和 40.3%，且成功解码不等于攻击成功，分层效果因模型而异。现有技能扫描器几乎无法识别这类注入技能。

正文

View PDF HTML (experimental)

Abstract:Third-party skills can expose LLM agents to malicious instructions hidden by encoding. We introduce Ciphered Skill Injection (CSI), which embeds such instructions in skill files for agents to decode and follow. We evaluate Caesar and layered variants across eight models and 139 injection-task pairs, separating instruction recovery from attack success. In the primary setting with shortened skills, the variants achieve attack success rates of up to 47.5% and 40.3%, respectively. Successful decoding does not guarantee attack success, and layering has model-dependent effects. The tested skill scanners rarely flag injected skills. These findings highlight the risk of promoting decoded, untrusted content into actionable instructions.

Subjects:	Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL)
Cite as:	arXiv:2610.18262 [cs.CR]
	(or arXiv:2610.18262v1 [cs.CR] for this version)
	https://doi.org/10.48550/arXiv.2610.18262 arXiv-issued DOI via DataCite (pending registration)

Submission history

From: Yan-Lun Chen [view email]
[v1] Tue, 13 Oct 2026 12:25:46 UTC (157 KB)

来源：arXiv：cs.AI · arxiv.org