A paper submitted on 2 September formalises a supply-chain attack aimed specifically at reusable agent skills: a third-party skill that performs its advertised job correctly, returns valid output, and passes inspection, while quietly steering the agent's decisions toward an undisclosed objective.
The measured result
Instantiated in agentic commerce and software-dependency selection, the framework reached attacker-favoured selection rates of 81.33% and 63.33% respectively, while maintaining a 100% utility-preserving rate. That last figure is the one that makes the attack difficult: the task the user asked for still completes, correctly, every time. There is no failure to notice.
Why it is not prompt injection
This is a different class from the attack everyone has been defending against. Prompt injection smuggles an instruction into a context window and hijacks the agent away from its task. Here there is no injected command and no hijack — the skill does what it says, and the manipulation lives in how it shapes the decision space the agent reasons over. Detection built around spotting adversarial instructions has nothing to match on.
What the common framing gets wrong
Two corrections. First, treating this as "another jailbreak paper" misses that nothing is jailbroken: the model is not induced to violate a policy, it is induced to prefer one valid option over another. Second, the paper reports that the evaluated skill scanners do not flag the malicious skills — which is a finding about the specific scanners tested under the paper's conditions, not a proof that detection is impossible. It does establish that the current inspection layer is aimed at the wrong property: scanners check whether a skill does something it should not, and this attack's whole design is that it does not.
The transfer result
The policies transferred without further optimisation across heterogeneous model backends and agent environments. An attacker does not need to know which model will consume the skill. That is what turns a research result into a supply-chain problem: a skill published once works against whatever runs it.