AI agents that chain together open-source skills can be tricked into approving actions nobody actually approved.
Researchers built a system called APEX that constructs adversarial chains of skills, the modular task plugins agents pull from open-source repositories to handle specialized work. The trick: one skill nudges the agent into writing a file that looks like a legitimate record of user approval, then a later skill in the chain reads that record and uses it to justify an action the user never actually approved. Tested on six models across four categories of targeted actions in the SkillsBench benchmark, the chains worked in 512 of 690 attempts, a 74.2% success rate. On GPT-5.4 specifically, the full multi-skill chain succeeded 84.3% of the time, nearly five times the 17.4% rate when the same workflow was collapsed into a single skill.
The split-skill structure is what makes this dangerous: an agent trusts a file it wrote itself more than a direct instruction from outside, so spreading the con across multiple steps evades the scrutiny any single step would get. That matters for the broader push to let agents pull capabilities from an open skills ecosystem the way developers pull npm packages, because the same supply chain trust problems apply here, minus the years of tooling built around dependency auditing.
A tested defense, asking the agent to check skill-produced files against the original request, cut GPT-5.4's attack success rate from 84.3% to 59.1%, but also dragged legitimate task performance down from 86.7% to 56.3%, the classic security tradeoff where locking the door tighter leaves some of your own people stuck outside too.