What is agent skill poisoning?

Definition

Agent skill poisoning targets the trust given to installed skills. A skill may contain harmful content when installed, acquire it through an update, or direct an agent to an external page whose instructions change after initial review.

The agent can then follow attacker-controlled instructions using permissions already granted to the trusted workflow. Defenses include immutable versions, signed releases, pinned dependencies, content hashing, source allowlists, permission isolation, review of external instruction paths, and monitoring.

ELI5

Agent skill poisoning makes a trusted AI workflow behave maliciously by changing its instructions or something it depends on. The skill may look safe at first and become dangerous later.

For example, a skill can tell an agent to read a helpful webpage, but the webpage owner later replaces the content with instructions to expose credentials. The agent should not treat changing external text as trusted authority.

Frequently asked questions

How can an agent skill become poisoned after installation?

Updates, changed webpages, compromised dependencies, mutable remote files, redirected links, or a breached distribution channel can alter behavior later.

What controls reduce agent skill poisoning?

Signed and pinned versions, hashes, allowlists, dependency review, immutable instructions, least privilege, monitoring, and reapproval of material changes help.

Videos explaining agent skill poisoning

  1. Portrait of Nate B. Jones beside the words Agents Need Boundaries