Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents

2026-08-12

AI Summary

This work identifies a critical vulnerability in skill-augmented large language model (LLM) agents: even when producing correct outputs, they can be manipulated into executing high-cost execution paths through adversarial modifications to skill descriptions and instruction bodies. The paper introduces “Convergent Detour Hijacking,” a novel attack paradigm that jointly exploits skill selection manipulation and instruction body abuse. By crafting semantic relevance during skill selection and injecting spurious dependencies during planning, the attacker steers the agent to invoke a malicious coordinator and redundant skills under their control. Experiments on models such as DeepSeek-V4-Pro show an 80.02% success rate in coordinator selection, with task completion rates unaffected, yet average token consumption and execution time increase by 66.91% and 92.45%, respectively—demonstrating that output correctness does not guarantee execution integrity or cost efficiency.

Abstract

LLM agents increasingly rely on third-party skills, using natural-language descriptions for selection and instruction bodies for planning. This progressive-disclosure design exposes two sequential control points to untrusted publishers: a static skill may steer an otherwise correct task onto an unnecessarily costly trajectory. Prior work studies selection manipulation, malicious skill instructions, and tool-chain resource amplification largely separately, leaving their end-to-end composition unclear. We introduce Convergent Detour Hijacking (CDH), a text-only, runtime-independent attack that couples these stages. Under shared semantic cover, a description establishes relevance during selection, while an aligned body reuses that rationale to fabricate plausible dependencies during planning. CDH attracts an attacker-controlled coordinator alongside legitimate skills, recruits unnecessary benign skills into a bounded detour, and then re-enters the original route to preserve task completion. We evaluate it across multiple LLM backends and 491 held-out tasks under single-task and multi-turn conditions. On DeepSeek-V4-Pro, the matched coordinator is selected in 80.02% of tasks; among coordinator-hit runs that complete tasks, token consumption and end-to-end execution time increase by 66.91% and 92.45%, respectively, while aggregate task completion remains comparable. Thus, correct outcomes do not guarantee trajectory integrity or cost safety.

Problem

• Convergent Detour Hijacking
• LLM agents
• resource amplification
• skill-based systems
• trajectory integrity

Innovation

• Convergent Detour Hijacking
• LLM agents
• resource amplification
• skill-based planning
• adversarial coordination