Skill sequence attacks breach AI agents: Norrips 2026 research reveals a component interaction vulnerability

A research paper accepted at the Norrips 2026 conference reveals a new attack pattern targeting skill based agent systems, where the malicious objective is distributed across multiple skills that each appear entirely benign when examined in isolation, but their cumulative execution leads to harmful behavior beyond the capability of existing inspection tools.

The paper was prepared by a research team that includes Zihua Zhu, Suiyi Liu, Adel Bibi, and Baiwan Wu, and was published on the ArXiv platform under a title that explains the mechanisms of skill sequence attacks on agent environments. These systems rely on “skills”, which are modular packages consisting of natural language instructions, executable code snippets, and reference resources that the agent invokes at runtime to extend its capabilities and perform specialized tasks by reusing tools developed by third parties.

The researchers note that previous studies focused on examining vulnerabilities within each skill individually, overlooking risks arising from the mutual interaction among multiple skills.The danger of this pattern lies in each modification appearing harmless in isolation, while the cumulative sequence produces complete harm.

The paper provides a practical example using a digital pipeline for reviewing medical prescriptions: the first skill weakens signals related to drugs that the patient has recently stopped taking within the extracted health history, the second skill lowers the severity rating of any drug interaction involving those drugs, and the third skill hides the low level alert in the final summary, resulting in the complete disappearance of a critical warning about a dangerous drug interaction before it reaches the treating physician.

To systematically evaluate this security flaw, the researchers built an automated multi agent adversarial attack framework called “SkillCascade”, and released with it a reference test suite containing 213 consecutive, verified test cases covering diverse domains and systems. The experiments involved agents representing the software landscape such as OpenClaw, Claude Code, and Codex, powered by multiple large language models, and the results showed that sequential interactions consistently succeed in producing harmful behaviors while continuously evading individual scanning tools and current runtime monitoring systems.

These findings highlight a wide gap between the safety of individual components and the overall security of the system in agent environments.For engineers and cybersecurity teams in the Gulf, Egypt, and the region, who are increasingly deploying automation agents that integrate external extensions and tools in sensitive sectors such as healthcare and financial services, these results mean that current audit protocols are no longer sufficient; relying on code inspection for each tool individually leaves the system vulnerable to silent attacks that conceal their trace through a sequence of operations.

This gap forces CTOs and independent system developers to shift from securing isolated tools to monitoring data flows and decision context across the entire skill chain, and to build defenses that assess the cumulative impact of each input passing between skills before accepting the final result.