ChronosAttack: Adversarial Tool Scheduling Attacks on LLM Agents
This paper introduces ChronosAttack, a novel adversarial technique that manipulates the timing of authentic tool responses in asynchronous LLM agents to alter decision outcomes without modifying the content, demonstrating that response order itself constitutes a significant attack surface across various models.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Modern artificial intelligence has evolved from systems that simply answer questions into agents capable of taking action. These agents act as digital assistants that can reach out to the outside world, using software tools to check a weather forecast, book a flight, or retrieve a database entry. They do not just read a static document; they interact with a dynamic environment, waiting for tools to finish their work and then using that new information to decide what to do next. This process relies on a sequence of events: the agent asks a question, the tool works, the tool sends back an answer, and the agent uses that answer to move forward. For these systems to be safe and reliable, we must understand not only what information they receive, but also how the timing of that information shapes their decisions.
Researchers have long known that the order in which information is presented can change how a human or a machine interprets a situation. If a list of options is shuffled, the choice at the top often feels more important than the one at the bottom. This paper explores a new and subtle way this principle can be exploited against AI agents. The study, titled ChronosAttack, investigates whether an attacker can change an agent's final decision simply by delaying the arrival of honest, unmodified tool responses. The attacker does not need to hack the tool, change the data, or inject false instructions. They only need to control the clock, holding back a specific piece of information just long enough to change the order in which the agent sees it.
The researchers tested this idea on four different, powerful AI models from major technology companies. They set up a scenario where an agent had to choose between three options based on three separate pieces of evidence provided by tools. In a normal situation, the tools would return their answers in a natural, logical order. In the attack scenario, the researchers introduced tiny, controlled delays to specific responses. These delays were so small they were measured in milliseconds—fractions of a second—but they were enough to shuffle the order in which the agent received the evidence. The content of the evidence remained exactly the same; only the timing changed.
The results showed that this simple manipulation of time could drastically alter the agent's choice. In some cases, the delay caused the agent to switch its decision to a specific target option with high confidence. For example, one model that initially chose an option only 10 percent of the time began choosing it 83 percent of the time when the order of the evidence was shifted. Another model showed an even more dramatic reaction, but in the opposite direction: when the order was changed, it abandoned its usual choice almost entirely. A third model remained relatively stable, showing that not all systems are equally vulnerable to this type of timing attack. The study found that the effect was not limited to agents that remembered past interactions; even when the agent processed all the information at once, simply changing the order in which the text appeared was enough to flip the decision.
The researchers also examined whether larger delays would cause stronger attacks. They found that the size of the delay mattered less than the specific order it created. A tiny delay that caused a single swap in the order of two pieces of evidence was often just as effective as a larger delay that caused multiple swaps. This suggests that the vulnerability lies in how the agent weighs the sequence of information, rather than in the magnitude of the disruption. To counter this, the team tested two defensive strategies. One strategy involved waiting until all tools had finished their work before presenting the results to the agent, ensuring the information arrived in a fixed, safe order. Another strategy involved asking the agent to make the decision multiple times with the information shuffled in every possible order and then only accepting an answer if the results were consistent. Both methods significantly reduced the attacker's ability to control the outcome, though their effectiveness varied depending on the specific AI model used.
This work reveals that the timing of tool responses is a security boundary that has been largely overlooked. It demonstrates that an agent's decision-making process is sensitive to the rhythm of its inputs, even when those inputs are completely authentic. The study does not claim that this vulnerability exists in every real-world system, nor does it suggest that all AI agents are equally at risk. Instead, it provides a clear proof that the sequence of events is a variable that can be manipulated to change outcomes. By showing that a delay of less than a second can shift a decision from one choice to another, the research highlights a new frontier in AI safety. It suggests that as these agents become more integrated into our digital lives, ensuring they are robust against the subtle influence of time will be just as important as protecting them from false data or malicious commands.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.