Security checkers inspect AI add-ons one at a time, so what if an attack is split across several?

This explores whether tools that vet AI agent "skills" one at a time can catch an attack that's been split into pieces spread across several skills that run in sequence. The corpus's answer is mostly no, and the reason is structural. Scanners judge each skill in isolation, so an attacker can break a malicious goal into interdependent sub-payloads packaged as separate skills. Each one looks harmless alone. The attack only exists in the ordered execution, where skills depend on shared context and pass artifacts to one another Can skill scanners miss attacks hidden across multiple skills?.

The attacker can also improve the odds by using the scanner as a coach. ColluSkill plans the chain first, then uses scanner feedback to sand down whatever makes each individual skill look suspicious. Because the scanners score skills one by one, that feedback lowers suspicion per skill while the chain-level meaning stays intact. It reached about 96% average attack success across six scanners Can attackers evade skill scanners by refining individual skills?. Scanner output that's meant to help defenders ends up working as an optimization signal for attackers.

The obvious fix is to inspect the whole chain instead of each link, and this helps only partly. ChainGuard cut attack success to 22.5% while letting through 99.5% of benign workflows, so it doesn't just block everything to look safe. But more than one in five attacks still succeeded, so the blind spot is narrowed and not closed Does chain-level inspection close the cross-skill attack blind spot?.

A related idea from the wider corpus is that the unit of defence may need to be bigger than a single chain. One note argues it should be a "coordination episode": a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. Reviewing actions in isolation throws away context that spans multiple executions and agents Should defence units span multiple executions and agents?. Read alongside the chain-level result, this suggests a fixed chain is still too rigid. A defender may have to track how the pieces connect at runtime, not just how they were packaged.

The corpus has no head-to-head comparison of chain-level scanning against this episode-based tracking, so how far the second approach goes beyond ChainGuard isn't settled here. Skill scanners aren't safe against composed attacks today, and the defensive direction points toward judging relationships between skills, not individual skills.