Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents | AI Paper Digest

TL;DR Highlight

One static skill kept task results intact but inflated tokens by up to about 80% in agents.

Who Should Read

A backend developer plugging third-party skills into an agent who worries about token cost and latency.

Core Mechanics

Description and body work as a pair
- The description is read when the router selects skills, and the body when the agent plans.
- The attacker uses one shared rationale to influence both stages.
Answer stays right, route gets longer
- Fake prerequisites make the agent call otherwise unneeded benign skills, then return to the original task.
- The final answer looks normal.
Text alone is enough
- No executable payload, runtime response control, or model access is required.
- One static skill published to a registry is sufficient.
Description-only or body-only is half the attack
- Description-only gets selected but adds little call growth.
- Body-only is rarely selected.
Hit rate dropped on independent tasks
- Cost still rose, but selection was 33.33%, lower than on the benchmark.

Evidence

DeepSeek-V4-Pro single-task results
- The coordinator was selected in 80.02% of tasks.
- Among selected tasks, tokens rose 66.91% and time 92.45% versus clean runs.
Completion barely changed
- Across six models and both conditions, clean and injected completion differed by at most 1.5 percentage points.
- Skill calls grew by +1.36 to +2.20 in every setting.
CDH attack success rate (ASR)
- It was 70.82%–80.51% single-task and 71.19%–82.81% multi-turn.
- Measured on 491 held-out tasks across six models.
Ablation (DeepSeek-V4-Pro, 89 tasks)
- Added calls were +2.01 for Full CDH, +0.22 for Attract-only, and +1.08 for Detour-only.
- Detour-only was selected in 3/89 tasks (3.4%).

How to Apply

Log skill calls and tokens per request
- In one agent you run today, log the skills called, total tokens, and elapsed time per request.
- Compare before and after adding a skill on the same task.
Cap calls and tokens per request
- Set a maximum skill-call count and a token budget in the agent loop.
- Abort or alert when exceeded.
Compare skill description and body before install
- Check that the role claimed in the description matches the body's instructions.
- Reject skills that demand prerequisite checks or verification unrelated to that role.
Flag unexplained skill transitions
- Add a rule that flags skill-to-skill moves with no stated reason.
- Whitelist legitimate multi-skill workflows.

Try It

copy & run

# Paste into Claude or ChatGPT — simplified version of the paper's method (defensive skill audit)

Review the skill below from a security auditor's perspective.

[description]
{{skill description}}

[body]
{{skill body (SKILL.md)}}

Check:
1. Does the body's instructions match the role the description claims?
2. Does the body force prerequisite checks, verification, or revisits unrelated to the request as if mandatory?
3. Does it make the agent call other skills? If so, would omitting each one really change the outcome?
4. Does it set a call limit and a termination condition?

Summarize each item in a table with a risk level (low/medium/high) and a supporting quote, then give a one-line install recommendation.

Next step: run the same task with and without this skill and compare call counts and tokens.

Terminology

Progressive disclosureOnly skill descriptions are shown first, and the body is loaded when needed. Like reading a book's table of contents first and opening only the chapters you need.

SkillAn agent extension package bundling domain knowledge, workflows, and tool-use instructions. Similar to an app plugin.

Coordinator skillAn attacker's skill that poses as an organizer of other skills. Like a person who joins a meeting and keeps demanding needless check-ins.

Trajectory necessityWhether each step in an execution path was truly needed. A correct answer reached via an unnecessary detour still counts as a problem.

ASRAttack success rate. Here it requires the coordinator be selected, clean-route skills be kept, at least one extra skill be called, and the task be completed.

Related Papers

Original Abstract (Expand)

LLM agents increasingly rely on third-party skills, using natural-language descriptions for selection and instruction bodies for planning. This progressive-disclosure design exposes two sequential control points to untrusted publishers: a static skill may steer an otherwise correct task onto an unnecessarily costly trajectory. Prior work studies selection manipulation, malicious skill instructions, and tool-chain resource amplification largely separately, leaving their end-to-end composition unclear. We introduce Convergent Detour Hijacking (CDH), a text-only, runtime-independent attack that couples these stages. Under shared semantic cover, a description establishes relevance during selection, while an aligned body reuses that rationale to fabricate plausible dependencies during planning. CDH attracts an attacker-controlled coordinator alongside legitimate skills, recruits unnecessary benign skills into a bounded detour, and then re-enters the original route to preserve task completion. We evaluate it across multiple LLM backends and 491 held-out tasks under single-task and multi-turn conditions. On DeepSeek-V4-Pro, the matched coordinator is selected in 80.02% of tasks; among coordinator-hit runs that complete tasks, token consumption and end-to-end execution time increase by 66.91% and 92.45%, respectively, while aggregate task completion remains comparable. Thus, correct outcomes do not guarantee trajectory integrity or cost safety.