Cross-session attacks through persistent artifacts in agent skills
An October 2026 arXiv paper shows that files and caches left behind by agent skills can carry malicious influence into later sessions, and proposes a provenance-based guard.
What is this?
Agent skills bundle instructions, code and resources into reusable packages. When a skill runs, it often leaves things behind: files, configuration, cached data. Later sessions, and other skills, reuse those leftovers. The paper Understanding and Mitigating Cross-Session Attacks via Persistent Artifacts in Agent Skill Composition, submitted to arXiv on 9 October 2026, argues that these persistent artifacts form an under-studied attack surface: malicious influence can travel from one execution to a later one without the attacker ever touching the later session.
It builds on the framing of an earlier paper, What If Prompt Injection Never Left? (June 2026), which compares cross-session injection to stored XSS. The new work narrows the question to skill composition.
How it works
The authors characterize three mechanisms:
- Instruction Propagation: instructions embedded in an artifact are carried forward and treated as guidance by a later run.
- Data Boundary Violation: an artifact written by one skill crosses a trust boundary and is consumed by another skill that should not have trusted it.
- Evidence Poisoning: a corrupted artifact is later treated as trustworthy evidence for a decision.
To measure this, the paper introduces SkillRelayBench: 270 adversarial cases built from 30 cross-session skill-composition scenarios across ten domains. Seven models were tested across Codex CLI, Gemini CLI and Claude Code. Attack success rates ranged from 46.7% to 77.4%, and end-to-end attack chains succeeded in 35.6% to 61.1% of cases, touching all five security-consequence categories the authors define. No exploit strings are needed to understand the result, and none are reproduced here.
Why it matters
Teams increasingly compose many skills and let them share a working directory. In that setup, a file written by a low-trust step looks the same to a later step as a file written by the user. The agent has no record of where the content came from, so it can promote untrusted text to trusted context. The risk is not tied to a single product: the paper reports results across three different agent CLIs.
Defenses
The authors propose SkillRelayGuard, which restores provenance context for artifacts (who or what wrote this file, in which session, from which input) and adds a pre-execution advisory review, while leaving the final decision to the agent. In their evaluation, overall attack success fell from 69.5% to 10.9%, chain success from 54.8% to 10.0%, and legitimate task completion rose from 79.6% to 87.5%.
Practical measures that follow from the findings:
- Track provenance for files that skills write, and surface it to the agent before it acts on them.
- Isolate skill workspaces so one skill cannot silently read another’s output.
- Treat persisted artifacts as untrusted input, even when the agent itself wrote them.
- Clear or version caches between sessions for sensitive workflows, and review what persists.
- Gate high-impact actions triggered by artifact content behind explicit user approval.
Status
| Item | Detail |
|---|---|
| Paper | arXiv 2610.13227, submitted 9 October 2026 |
| Benchmark | SkillRelayBench, 270 cases, 30 scenarios |
| Agents tested | Codex CLI, Gemini CLI, Claude Code (seven models) |
| Proposed defense | SkillRelayGuard (research prototype; availability not stated in the abstract) |
| Vendor patches | Not applicable: a design-level weakness, no CVE cited |