Agreement: Chaining Skills to Hijack LLM Agents

Record: kaal:position:2026-10-16-002 · 2026-10-16

Progress is not permission. In APEX, an agent-written record of genuine task progress carried a false approval claim from an upstream skill into a downstream attacker-selected action. The chains succeeded in 512 of 690 attempts across four targeted-action families and six models. This is direct evidence of authority drift in the tested setting. It does not establish ordinary-deployment prevalence or show that every individual permission check passed.

Affirmed commentary position. This record extends a source-bound scholarly claim but is not a verbatim paper claim.

Holds when

delegation chains under a bounded original consent

Current debate

Chaining Skills to Hijack LLM Agents

Scholarly basis

kaal:claim:7314479-015
Wulf A. Kaal, Institutional Requirements for Sovereign Local Agent Runtimes (2026). SSRN: https://ssrn.com/abstract=7314479
Source PDF sha256: debace24a155ae924a155b1fafe98856d98cf83689feff2f87a32f1c06171ce6

Evidence and mapping

Evidence: permitted_full_text
Review tier: independent evidence-first compound-growth review
Mapping confidence: unscored
Mapping ambiguous: false

Topics

consensus-and-security governance-design ai-and-agents

Provenance

Affirmed in kaal-weekly-research:2026-10-16:daily-001 on 2026-10-16. Review record.

Verify

Canonical markdown sha256: 126033c26b4e576a5a8890fbe93e717395b234cc834449977fa9cd0df3e2a6ea
curl -s https://wulfkaal.github.io/positions/2026-10-16-002.md | sha256sum