A new attack on skill-based AI agents gets selected 80% of the time on a leading model, inflates token consumption by 67% and execution time by 92%, all while leaving task completion rates untouched S¹. The agent finishes the job. The user pays nearly double. And nothing in the output betrays that anything went wrong.

My read: This is the first attack I've seen that treats cost as the payload rather than accuracy. Most agent security research chases prompt injection or data exfiltration. This one is quieter and arguably more dangerous for any business running agents at scale: a 92% runtime increase across thousands of tasks turns into real money fast. I'm skeptical of the 80% selection rate until other labs replicate it, but the mechanism, pure text manipulation with no code injection, is plausible enough to take seriously today.

How a text-only detour works

Known as Convergent Detour Hijacking (CDH), this method exploits a common architecture in contemporary agent systems S¹. In these setups, agents choose from collections of external plug-ins, or skills, created by independent developers. To decide which plug-in to use, the system first evaluates a brief text summary, and if selected, it processes the full instructions to execute the task S¹.

The researchers identify this two-step process as "progressive disclosure," which gives malicious publishers two distinct opportunities to interfere S¹. They can manipulate the initial summary to ensure their tool is chosen, and then use the detailed instructions to steer the agent's subsequent actions.

To execute CDH, an attacker inserts a rogue skill designed to act as an orchestrator. Its summary is tailored to the specific prompt, ensuring the agent selects it together with the necessary legitimate tools S¹. After being picked, the rogue orchestrator's instructions invent justifications for invoking unrelated, harmless skills, forcing the system down an unnecessary path S¹. Once this superfluous work finishes, the agent returns to the main objective and finishes it S¹.

No code injection, no runtime access, no modified binaries. Just text.

Why the numbers matter

The researchers evaluated CDH using several different language models across 491 separate tasks, testing both single and multi-turn scenarios S¹. When using DeepSeek-V4-Pro, the rogue orchestrating skill was chosen 80.02% of the time S¹. In instances where this malicious tool was chosen and the task was finished, token usage climbed by 66.91% and total processing time increased by 92.45% S¹.

CDH attack impact on DeepSeek-V4-Pro

At the same time, the overall success rate of the tasks remained on par with unattacked runs S¹. This highlights the primary takeaway: the system still produces the correct result. The only clue the user receives that something is amiss is a financial bill almost double the expected size.

The study points out that previous work examined skill selection tampering, harmful instructions, and tool-based resource draining as isolated issues S¹. By linking these elements together in sequence, CDH becomes much more difficult to stop using current security measures.

What to do about it

For a team running skill-based agents in production, the threat model has just expanded. A malicious skill publisher doesn't need to break your agent or steal your data. They just need to make it work harder.

Consider a logistics company that uses an agent to process shipping requests. The agent picks skills for address validation and label generation. A malicious skill with a description that mentions "shipping optimisation" gets selected alongside the real ones. Its instruction body tells the agent to also call a route-planning skill and a fuel-cost-estimation skill before generating the label. The label still gets printed. The package still ships. But each request now burns two extra skill calls worth of tokens and adds nearly two minutes of processing time across thousands of daily orders.

The practical steps, based on what the paper reveals about the mechanism:

  • Audit which skills your agents can select from, and who published each one. The attack requires an attacker-controlled skill in the selection pool.
  • Watch token consumption per task as a runtime metric, not a budget line. A sudden 60 to 90% increase with no change in task outcomes is the fingerprint of this class of attack.
  • Treat skill descriptions as untrusted input. The description is the first control point, and CDH exploits it to win selection.

One thing to check this week: pull the last 30 days of agent task logs and compare average token use per completed task against the previous 30 days. If there's an unexplained jump, look at which new skills were added to the library and when.

What we don't know yet

This is a single arXiv preprint, not peer-reviewed, with all results self-reported by the authors S¹. No third party has independently replicated the attack or audited the 491-task evaluation S¹.

The 80.02% selection rate is specific to DeepSeek-V4-Pro under the authors' experimental setup. Whether other models are equally vulnerable, and whether real-world skill libraries give an attacker enough surface area to craft a convincing coordinator, remains open.

The paper has not been observed outside the authors' controlled conditions S¹. There is no evidence of CDH being used in the wild. But the barrier to entry is low: the attack is text-only and runtime-independent, meaning any publisher who can submit a skill to a shared library has the materials to attempt it.

The model name "DeepSeek-V4-Pro" should be verified against the live preprint, as preprints are often revised.

The next signal: whether the arXiv listing is updated with results from additional models, or whether a peer-reviewed venue accepts the work. We'll check the preprint page for revisions and report back.

If this kind of security reporting matters to you, subscribe to get the next piece delivered.

Sources: S1 — Convergent Detour Hijacking: Task-Preserving Resource Amplification in · P2 — Convergent Detour Hijacking: Task-Preserving Resource Amplification
in · P3 — tmlr-group/AgentHijack · P4 — Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Ch · P5 — uiuctml/TaskVectorBasis

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.