Daydreaming Steals a Hidden Multi-File Agent Skill at 86.8% Capability From a Median of 32 Ordinary Task Calls

arXiv 2608.26733·high signalXBlueskyLinkedInCopy link

arXiv 2608.26733 presents an execution-only attack that reconstructs a hosted agent skill without ever asking the victim to reveal or grade it, instead submitting crafted but ordinary tasks whose results discriminate between candidate hidden behaviors. At the weakest access level (Output only: final response plus returned files) it recovers 86.8% of the original skill's capability across 7 skills and 4 victim models, nearly 4x SigLeak, producing an installable skill from a median of 32 victim calls with disclosure defenses enabled. Anyone selling skill-gated agent access should assume file secrecy and disclosure filters do not protect the asset.