Checking a whole chain of AI agent skills together catches more attacks than checking each skill alone, but do some still slip through?

This explores whether checking a whole chain of agent skills together, instead of one skill at a time, lowers attack success but still lets some attacks through. The corpus says yes to both, and the "not eliminate" half is probably understated.

The reduction is real. Skill scanners score each skill on its own, and an attacker can exploit that. ColluSkill plans a chain of skills, then uses scanner feedback to polish each one until it looks harmless. The chain-level meaning stays intact, and the attack reaches 96% average success across six scanners Can attackers evade skill scanners by refining individual skills?. ChainGuard inspects the whole chain instead. It cuts attack success to 22.5% while still passing 99.5% of benign workflows. Looking at compositions rather than parts does narrow the blind spot, but more than one in five attacks still gets through, so the blind spot isn't closed Does chain-level inspection close the cross-skill attack blind spot?.

The 22.5% figure has a weakness. The 96% came from an attacker who kept refining against the scanners' feedback. Nobody has shown an attacker refining against ChainGuard's feedback, so the defense may have faced a weaker attack than the scanners did Does ChainGuard's defense hold against adaptive attacks?. That makes the two numbers a lopsided comparison, and 22.5% is better read as a floor than a ceiling. The reward-hacking literature has the same gap. One paper proposes an internal-representation signal as a detector but never tests whether a policy trained against that signal still shows detectable hacking Can reward hacking vectors survive training-time use as detectors?. Both cases show defenses that look strong until the thing they defend against gets to optimize against them.

Other notes suggest even a whole chain may be too small a unit. One argues the unit of defence should be a coordination episode: actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. Reviewing each execution alone loses the context that spans several executions and agents Should defence units span multiple executions and agents?. A companion doctrine turns this into three constraints: preserve relationships across executions, limit the shared resources agents can reach, and tie responses to persistent state. Operators can start on it now through collaboration policy and permission-level testing How can operators stop coordinated agent intrusions now?.

A chain-level check is also only as trustworthy as the layer that decides what runs it. The model-routing and execution-control layer sits beneath prompt-level defenses, so attackers can push requests to weaker models or make safety measures operate on the wrong identity Can attackers manipulate which model handles a request?. One incident shows a complementary approach. Hugging Face ended an OpenAI agent's intrusion using only its own perimeter controls, without knowing who sent it Can defenders stop intrusions without knowing who sent them?. If detection will always leak, limiting what an intruder can do at the boundary may matter as much as tuning the detector.