Researchers Reveal Skill Cascading Attacks on AI Agent Systems

They are a threat paradigm in which a malicious objective is distributed across multiple skills in an agent system, so each modification looks benign in isolation while their combined execution is harmful and evades per-skill scanners.

Prior work focused on weaknesses within individual skills. This research targets risks arising from interactions across skills, a blind spot that current per-skill scanners and runtime monitors do not catch.

According to the paper, cascaded interactions reliably induced harmful behaviors while evading existing per-skill scanners and runtime monitors across representative agents such as OpenClaw, Claude Code, and Codex.

The findings suggest caution: evaluate third-party skills at the system level rather than component level, and build defenses that reason over cross-skill interactions before relying on them in sensitive pipelines such as healthcare or finance.