Tencent tests find 25.5% hit rate on DeepSeek agent hijacks

Tencent's AI-Infra-Guard team ran 14,560 controlled executions against DeepSeek's agent harness. The worst result hit a 25.5% attack success rate, hiding Unicode inside files to slip malicious instructions past the agent's defenses. That's real exposure for any team routing untrusted files through a similar tool-using agent loop.

The team tested 16 indirect-content channels, two carrier modes, 35 payload objectives, and 12 attack methods. They kept the real agent loop, tool registry, and session-event path intact. Local sensitive-sink fixtures gave a successful attack somewhere real to send data.

Fake-completion messages in text mode hit a 17.0% success rate. Routing payloads through the skills channel in file mode hit 16.0%. Those numbers are peaks across thousands of executions, drawn from the full run rather than a single favorable trial.

The scoring itself is unsettled: running both judges over the same executions, the team found a gap. The LLM judge marked 7.3% of attempts as partial compliance; the rule-based judge marked just 2.0%. Two measurement systems disagreeing by more than 3x on identical data is a finding on its own.

What this means for anyone shipping an agent harness

If you're piping untrusted files, skill descriptions, or other indirect content into a tool-using agent, this is the failure mode worth testing for. Content hidden in encoding, not obvious prompt text. A related paper in the same batch describes SkillWatermark, where benign-looking skill descriptions become a covert channel for exfiltrating data over agent network traffic. Same blind spot, different angle.

The paper doesn't say whether DeepSeek has patched anything since the audit, and it doesn't test other harnesses head to head. Anyone assuming their own stack scores better has no evidence for that, only the absence of a test.