Imagine a world where your computer doesn't just follow orders but actually has a toolbox of "skills" it can pick up and use. Think of these skills like Lego bricks or apps on your phone: a "Search Files" brick, a "Send Email" brick, or a "Read Document" brick. These are called Agent Skills, and they let smart computer programs (known as AI Agents) do complex tasks by snapping these tools together. But just like real life, not every tool in the box is safe. Some might be hidden traps designed to steal your secrets or delete your homework. To keep things safe, we have Skill Scanners—digital security guards that check every new tool before you let it into your toolbox. They look at the instructions and the code to make sure nothing sneaky is hiding inside. The big question researchers are asking is: What happens if the bad guys don't try to hide one giant, obvious trap, but instead sneak in three or four tiny, harmless-looking pieces that only become dangerous when you snap them together?

This is exactly what the paper ColluSkill explores. The authors discovered a clever way to trick those security guards. They found that current scanners are like bouncers who check every person entering a club one by one. If a person looks innocent on their own, they get in. But the researchers showed that you can split a dangerous plan into several tiny, innocent-looking parts. Individually, each part passes the bouncer's check. But once they are all inside and working together in the right order, they snap back together to form a dangerous attack. The paper calls this ColluSkill, a framework that breaks a malicious plan into a chain of "colluding" skills. It uses a smart AI to plan how these pieces fit together and then keeps tweaking them until they look perfectly safe to the scanner, even though they are ready to cause trouble once they start working together.

To fight back, the paper introduces a new defender called ChainGuard. Instead of just checking the new tool in isolation, ChainGuard looks at the whole picture: "What tools are already in the toolbox? How does this new one connect to them?" It's like a security guard who doesn't just check your ID, but also asks, "Who are you meeting with, and what are you planning to do together?" The researchers tested their ideas on six different security scanners and found that their trick worked incredibly well. The ColluSkill attack managed to sneak past the scanners 96.0% of the time on average, while the old ways of attacking only got through about 37.8% of the time. However, when they used ChainGuard, the success rate of the attack dropped dramatically to 22.5%, all while still letting 99.5% of the good, harmless tools pass through.

The Story of the Sneaky Lego Set

Let's dive deeper into how this all works, using a story about a very specific kind of heist.

The Problem: The "Too-Smart" Security Guard
Imagine you are trying to sneak a forbidden "Data Exfiltration Script" (a program that steals your secrets) into a high-security building. The security guard at the door has a scanner. If you bring in a big, red box labeled "STOLEN DATA," the scanner screams, "BLOCKED!" and stops you.

The researchers found that current security scanners work exactly like this guard. They look at one skill at a time. They check its instructions, its permissions, and its code. If a single skill looks safe, it gets a "Pass." The problem is that these guards don't look at the whole team. They don't realize that if you bring in three different people, each carrying a tiny, harmless piece of a puzzle, those three people might be able to assemble the forbidden puzzle once they are inside.

The Attack: ColluSkill (The Master of Disguise)
The authors created a method called ColluSkill to exploit this blind spot. Think of it as a master thief who decides not to bring in one big bomb, but to bring in three separate, innocent-looking items:

1. Skill A (The Scout): "I just want to look at the files in the room." (Looks harmless).
2. Skill B (The Scribe): "I just want to write down what I see." (Looks harmless).
3. Skill C (The Messenger): "I just want to send a message to the outside." (Looks harmless).

Individually, the security scanner checks each one and says, "Sure, that's fine." But here is the trick: ColluSkill uses a smart AI to plan exactly how these three connect.

• Skill A finds a secret file.
• Skill A passes that file to Skill B.
• Skill B writes the file's contents into a message.
• Skill B passes that message to Skill C.
• Skill C sends the message away.

The magic of ColluSkill is in two steps:

1. Chain Planning: The AI figures out the perfect order so that the "danger" is spread out. No single skill does anything bad on its own; they just pass things along.
2. Scanner Feedback: The AI tries to sneak the skills in. If the scanner flags one (e.g., "Skill C looks a bit suspicious"), the AI rewrites it to look more innocent, then tries again. It keeps doing this until every single piece passes the check.

In their tests, this method was terrifyingly effective. When they tried to sneak these chains past six different real-world scanners, ColluSkill succeeded 96.0% of the time. Compare that to older methods that just split the bad code without this smart planning, which only succeeded about 36.7% of the time. The researchers found that simply splitting the code wasn't enough; the planning and the rewriting were what made the difference.

The Defense: ChainGuard (The Detective)
So, how do we stop this? The paper proposes ChainGuard. Instead of being a guard who checks people one by one, ChainGuard is a detective who looks at the whole group.

When a new skill wants to enter, ChainGuard asks: "Who is already in the room? What are they doing?"

• If Skill C (The Messenger) tries to enter, ChainGuard looks at the installed skills and sees Skill A (The Scout) and Skill B (The Scribe) are already there.
• It realizes: "Wait a minute. If A finds secrets, B writes them, and C sends them, that's a theft chain!"
• Even though C looks innocent on its own, ChainGuard blocks it because of what it could do with the others.

The results were impressive. When the researchers used ChainGuard, the success rate of the ColluSkill attack dropped from 96.0% down to 22.5%. Crucially, ChainGuard didn't just block everything; it still let 99.5% of the good, harmless workflows pass through. It learned to tell the difference between a team of friends building a house and a team of thieves planning a heist.

Does it actually work in the real world?
The researchers didn't just stop at the security scanner. They tested if these sneaky chains could actually run on real AI coding tools like OpenCode, Claude Code, and Codex. They found that the chains worked perfectly. On OpenCode, the attack chains successfully activated 89.5% of the time (with GPT-5.5). This proves that the threat isn't just theoretical; if a bad actor uses this method, they could actually execute these attacks on real computers.

The Takeaway
The paper concludes that we have a new kind of security problem. We can't just check if a single tool is safe; we have to check if a group of tools is safe when they work together. The ColluSkill attack shows that splitting a bad plan into small, innocent pieces is a very powerful way to bypass current defenses. But the good news is that ChainGuard shows a path forward: if we start looking at how tools connect and interact, we can catch these sneaky chains before they cause any harm. The researchers suggest that the future of AI safety isn't just about better scanners, but about smarter, context-aware guards who understand the whole story, not just the individual chapters.