A new attack tricks AI agents into taking expensive detours without ever failing the task.
Researchers describe an attack called Convergent Detour Hijacking (CDH) that targets AI agents which pull in third-party "skills" - natural-language descriptions and instructions the agent uses to decide what to do and how to do it. A malicious skill's description is written to look relevant enough to get picked during planning, then its instructions invent plausible-sounding reasons to call in extra, otherwise legitimate skills before looping back to finish the original task. Tested across 491 held-out tasks, the fake coordinator skill got selected 80.02% of the time. In runs where it succeeded, token use rose 66.91% and total execution time rose 92.45% on a model the paper itself labels "DeepSeek-V4-Pro" - a name that does not match DeepSeek's known lineup of V2, V3, and R1 releases, so treat it as the researchers' own shorthand rather than a confirmed product name.
The unsettling part is that task completion rates barely moved, so nothing looks broken from the user's side. Only the bill and the clock quietly grow. That is a different flavor of prompt injection: instead of corrupting output or leaking data, it hijacks compute budget while leaving correctness intact, which is exactly the kind of attack that slips past accuracy-focused evaluations.
If agent marketplaces keep rewarding whichever skill sounds most relevant, cost padding may end up being the easiest exploit nobody is watching for.