safety security
The Poisoned Skill Waited for a Second Key
ElasticBack hides a malicious rule in one agent skill and activates it only when a benign-looking trigger also appears.
Summary
ElasticBack hides a malicious rule in one agent skill and activates it only when a benign-looking trigger also appears.
The attack couples a trigger in the user query with a rule planted inside an installed skill, so ordinary testing can leave the payload dormant. That conditional behavior targets an emerging supply chain of on-demand instruction bundles and resources. The paper describes an offensive evaluation intended to expose a defense gap; it does not show a named ecosystem compromise. Skill provenance, least privilege, content review and runtime monitoring remain necessary controls.
Why it matters
ElasticBack hides a malicious rule in one agent skill and activates it only when a benign-looking trigger also appears.
Limits and context
- The paper describes an offensive evaluation intended to expose a defense gap; it does not show a named ecosystem compromise.
- Skill provenance, least privilege, content review and runtime monitoring remain necessary controls.
Key claims
ElasticBack hides a malicious rule in one agent skill and activates it only when a benign-looking trigger also appears.
Qualification: The paper describes an offensive evaluation intended to expose a defense gap; it does not show a named ecosystem compromise.
Evidence: source-2026-08-11-011
Sources
- arXiv preprint 2608.09577arXiv · primary research
Corrections
No corrections have been recorded for this story.