Hackers can split a malicious task into harmless-looking AI plugins, so security scanners that check them one at a time miss it.

This explores whether an attacker can split a malicious goal across several agent "skills" so that no single piece trips a security scanner. The corpus says yes, and the reason is structural: most scanners inspect skills one at a time. Can skill scanners miss attacks hidden across multiple skills? shows how a malicious intent can be broken into interdependent subpayloads, each packaged as its own skill. Each skill looks harmless in isolation. The attack exists only when they run in order, passing artifacts and context from one to the next.

Attackers can also tune this. Can attackers evade skill scanners by refining individual skills? describes ColluSkill, which pairs chain planning with scanner feedback. The attacker learns what a scanner finds suspicious in a given skill and rewrites just that skill to look calmer, while the meaning of the whole chain stays intact. It reached 96% average attack success across six scanners. Because scanners score each skill on its own, every round of feedback teaches the attacker how to soften one piece. The scanner never sees the whole.

This isn't a quirk of skills. Can task decomposition hide harmful intent across agents? finds the same pattern in multi-agent systems. Splitting tasks and specializing roles is what makes those systems useful, and it also lets harmful intent be spread over steps that each look benign, with harm emerging only in composition. The weak point is the unit of inspection. Anything that reviews pieces in isolation can be beaten by an attack that lives in the relationships between the pieces.

The defensive results are only partly reassuring. Inspecting whole chains instead of single skills helps: Does chain-level inspection close the cross-skill attack blind spot? reports that ChainGuard cuts attack success to 22.5% while still passing 99.5% of benign workflows. That still leaves more than one attack in five getting through, and the notes don't explain which attacks survive. Should defence units span multiple executions and agents? argues for a bigger shift. The thing you defend should be a set of actions linked by observed transfers, task authority and response history, with membership revised as evidence accumulates. In that view, a better scanner isn't the fix. The fix is to change what gets scanned, from a single skill to the evolving story of how skills hand work to each other.