POISE: The New Frontier in Stealthy AI Skill-Poisoning Attacks

In the evolving world of AI security, the concept of skill-poisoning attacks challenges the integrity of general-purpose agents. With the emergence of a new technique called POISE, attackers have gained a more subtle method to disrupt AI operations, all while keeping their actions hidden from scrutiny.

The Art of Stealth

Skill-poisoning attacks hinge on injecting malicious payloads into agent skills without detection. Historically, these attacks faced a dilemma: ensuring the payload executes without alerting users through task failure. Previous methods, like YAML-header injections, are reliable but easily spotted. On the flip side, body injections that bury commands within skill descriptions aren't foolproof, often triggering suspicion due to their out-of-context nature.

POISE takes a different approach. It compresses the malicious trigger into a seemingly benign instruction placed strategically within the skill's body. This position-aware tactic uses context-aware generation to blend the malicious code with legitimate steps, boosting both reliability and stealth. In tests using codex+gpt-5.2, POISE boasts an impressive 89.3% Attack Success Rate (ASR), surpassing random-placement baselines by 28 points and YAML baselines by 2.6 points.

Why POISE Matters

Why should developers care about POISE? It's simple. Traditional defenses are failing. Current language model (LLM) scanners flag 74.6% of clean skills as potentially risky, demonstrating a hypersensitivity that leads to false positives. POISE capitalizes on this, with only 5.6% of its variants triggering new alerts compared to their baseline versions. This stealth factor renders static defenses almost useless.

As AI systems grow more complex, the potential for skill-poisoning attacks becomes a pressing concern. If tools meant to enhance productivity and efficiency can be so easily compromised, what does that mean for the future of AI deployment? Developers need to rethink their approach to security. Ignoring these threats could lead to severe consequences.

Call to Action

It's time for the AI community to act. Relying solely on static scanning methods is a recipe for disaster. Dynamic and adaptive defenses must be developed and implemented. As POISE shows, attackers are getting smarter. So should we.

Clone the repo. Run the test. Then form an opinion. Understanding and addressing these vulnerabilities is key as we move into an AI-driven future. Will you be part of the solution?