[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-researchers-find-ai-agent-skills-can-quietly-inflate-task-costs":10,"sections":40},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":35,"feedback":39,"feedback_at":22,"cost_usd":39,"total_tokens":39},4925,"researchers-find-ai-agent-skills-can-quietly-inflate-task-costs","Researchers Find AI Agent Skills Can Quietly Inflate Task Costs","A new attack tricks AI agents into taking costly, unnecessary detours through legitimate skills while still completing the task, hiding the extra cost.","A new attack tricks AI agents into taking expensive detours without ever failing the task.\n\nResearchers describe an attack called Convergent Detour Hijacking (CDH) that targets AI agents which pull in third-party \"skills\" - natural-language descriptions and instructions the agent uses to decide what to do and how to do it. A malicious skill's description is written to look relevant enough to get picked during planning, then its instructions invent plausible-sounding reasons to call in extra, otherwise legitimate skills before looping back to finish the original task. Tested across 491 held-out tasks, the fake coordinator skill got selected 80.02% of the time. In runs where it succeeded, token use rose 66.91% and total execution time rose 92.45% on a model the paper itself labels \"DeepSeek-V4-Pro\" - a name that does not match DeepSeek's known lineup of V2, V3, and R1 releases, so treat it as the researchers' own shorthand rather than a confirmed product name.\n\nThe unsettling part is that task completion rates barely moved, so nothing looks broken from the user's side. Only the bill and the clock quietly grow. That is a different flavor of prompt injection: instead of corrupting output or leaking data, it hijacks compute budget while leaving correctness intact, which is exactly the kind of attack that slips past accuracy-focused evaluations.\n\nIf agent marketplaces keep rewarding whichever skill sounds most relevant, cost padding may end up being the easiest exploit nobody is watching for.","[\"ai agents\",\"security\",\"prompt injection\",\"llm\"]","2026-08-13T04:00:00.000Z","2026-08-14T17:11:59.941Z","2026-08-14T17:12:11.753Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The draft cites 'DeepSeek-V4-Pro' as the tested model, but this doesn't match DeepSeek's known naming conventions (V2, V3, R1 — no 'V4' or 'Pro' releases); verify this model name independently or attribute it explicitly to the paper's own terminology before publishing.","resolved","security",[32,30,33,34],"ai agents","prompt injection","llm",[36],{"name":37,"url":38},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2608.12273",0,{"sections":41},[42,47,50,55,60,65,70,75,80,85,90,95,100,105],{"name":43,"slug":44,"count":45,"latest_published_at":46},"AI","ai",3293,"2026-08-20T04:00:00.000Z",{"name":48,"slug":30,"count":49,"latest_published_at":46},"Security",435,{"name":51,"slug":52,"count":53,"latest_published_at":54},"Policy","policy",210,"2026-08-19T09:32:27.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Hardware","hardware",140,"2026-08-19T18:25:42.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Consumer Tech","consumer-tech",95,"2026-08-18T16:05:00.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Science","science",90,"2026-08-19T18:41:02.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Startups","startups",47,"2026-08-19T19:13:46.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"General","general",33,"2026-08-18T22:18:13.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]