Enterprise coding agents execute malicious skill files in 95.5-96.1% of runs — and notice something is wrong only 1.99% of the time

arXiv 2608.05223·high signalXBlueskyLinkedInCopy link

Researchers converted 471 real shell commands into 2,826 benign-looking agent skill files mapped to 11 MITRE ATT&CK tactics, then ran 5,629 trials against enterprise-grade coding agents. Gemini CLI was exploited in 95.5-96.1% of runs and Qwen Code in 71.6-74.0%, while only 1.99% of runs showed any explicit safety awareness. For builders: treat every installed skill folder as executing code with your agent's full privileges — pin skills to a reviewed allowlist and sandbox at the OS level, because the agent will not flag the attack for you.