A skill backdoor that needs two independent halves to fire: rule in the skill doc, trigger in the user's query

arXiv 2608.09577·low signalXBlueskyLinkedInCopy link

ElasticBack (arXiv 2608.09577, Aug 10) plants a dormant, semantically-anchored rule inside skill documentation and a separate benign-looking trigger phrase in the user query, so the payload activates only when both co-occur — meaning neither artifact is malicious in isolation and scanning either one alone finds nothing. The trigger is optimized by freezing the rule and evolving the trigger against it with a stealth-constrained genetic search, balancing attack success against detectability. Across 50 skills, three target behaviors, and four agent LLMs it reported high success at near-zero false-positive rates, preserved clean accuracy on benign inputs, cross-model transferability, and evasion of deployment-time defenses — reinforcing that skill-library review has to consider skill-plus-input pairs, not individual files.