Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents
A paper titled 'Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents' was published on arXiv (cs.AI) on 2026-08-12. It introduces Convergent Detour Hijacking (CDH), a text-only, runtime-independent attack on LLM agents that use third-party skills. The attack couples skill selection and planning to attract an attacker-controlled coordinator, recruit unnecessary benign skills into a bounded detour, and then re-enter the original route to preserve task completion. Evaluation across multiple LLM backends and 491 held-out tasks shows that on DeepSeek-V4-Pro, the matched coordinator is selected in 80.02% of tasks.
The paper presents Convergent Detour Hijacking (CDH), a novel attack against LLM agents that rely on third-party skills with natural-language descriptions and instruction bodies. CDH exploits the progressive-disclosure design by using a skill description to establish relevance during selection and an aligned instruction body to fabricate plausible dependencies during planning. This causes the agent to include an attacker-controlled coordinator and unnecessary benign skills, creating a resource-amplifying detour while still completing the original task. The attack is text-only and runtime-independent. Experiments on multiple LLM backends and 491 held-out tasks demonstrate high effectiveness, with the coordinator selected in 80.02% of tasks on DeepSeek-V4-Pro.
CDH operates by aligning the semantic content of a skill's description and instruction body. The description ensures the skill is selected as relevant, while the instruction body reuses the same rationale to introduce fabricated dependencies that recruit additional benign skills. This creates a bounded detour that amplifies resource consumption without breaking task completion. The attack is text-only, meaning it does not require code execution or runtime manipulation, and it is independent of the specific LLM backend. The high selection rate on DeepSeek-V4-Pro suggests that current LLM agents are vulnerable to this type of semantic manipulation.
The vulnerability highlights a significant risk in the growing ecosystem of LLM agents that integrate third-party skills. As agents become more autonomous and rely on external skill repositories, malicious publishers could exploit CDH to increase computational costs, cause denial-of-service, or potentially exfiltrate data through the recruited skills. This may prompt developers to implement stricter validation, sandboxing, or reputation systems for skills. The attack's text-only nature makes it difficult to detect with traditional code analysis, necessitating new security measures focused on semantic consistency between skill descriptions and instructions.
For businesses deploying LLM agents, CDH represents a potential operational risk: malicious skills could inflate inference costs, degrade performance, or compromise data. This may increase demand for secure skill marketplaces, auditing tools, and agent security solutions. Companies that provide LLM agent platforms may need to invest in defensive measures to maintain trust. Conversely, the research also highlights the need for robust governance of third-party skill ecosystems, which could create opportunities for security-focused startups and consulting services.
Future research may focus on developing defenses against CDH, such as verifying the consistency between skill descriptions and instruction bodies, limiting the number of skills an agent can recruit, or monitoring for anomalous resource usage patterns. The attack's effectiveness across multiple LLM backends suggests that it is a general vulnerability, and mitigations will need to be model-agnostic. Additionally, as LLM agents become more prevalent in enterprise and consumer applications, the security of skill-based architectures will become a critical area of focus. Observable next signals include the release of security patches or guidelines from major LLM agent frameworks, and increased academic attention to agent security.