Checking AI plug-ins two at a time sounds safe, so how can a longer chain still smuggle in an attack?

This explores why checking skills two at a time (or in small groups) still leaves room for attacks that span a longer chain of skills. The core issue is that a scanner judges what a skill looks like, but the attack lives in what a sequence of skills does. Can skill scanners miss attacks hidden across multiple skills? describes the basic trick: split a malicious goal into interdependent subpayloads, package each as its own skill, and let ordered execution finish the job by passing artifacts and context from one step to the next. Each piece looks harmless alone. The harm only exists in the composition.

Pairs help less than you'd expect because an attacker can pick how many links the chain has. A pair-level scanner sees only adjacent handoffs, so an attacker can spread the payload across three or four skills, with each adjacent pair looking innocuous. The attacker can also tune the pieces. Can attackers evade skill scanners by refining individual skills? shows ColluSkill combining chain planning with scanner-feedback refinement to reach 96% average attack success across six scanners. Because scanners score units in isolation, the attacker can keep rewriting each unit until its suspicion score drops, while the chain-level meaning stays intact. Widening the unit from one skill to two moves the boundary without removing it.

The same pattern shows up outside skills. Can task decomposition hide harmful intent across agents? and Why do single-message classifiers miss cross-agent harms? show that in multi-agent systems, the strengths of splitting tasks and specializing roles create a blind spot. A harmful objective can fragment into locally benign subtasks, and classifying individual messages misses it. The proposed fix is to track how semantic content flows through the system, not to judge each message on its own. Can stateless checks ever catch sequence-level constraint violations? gives the structural reason. A check that sees only the current action can't express a rule that depends on what came before, so only stateful monitors that follow composed behavior can enforce those rules.

The corpus suggests the right unit of inspection is the whole chain or coordination episode, but that this too only narrows the gap. Does chain-level inspection close the cross-skill attack blind spot? reports that ChainGuard cuts attack success to 22.5% while passing 99.5% of benign workflows. That is a real improvement, but more than one in five attacks still gets through. Should defence units span multiple executions and agents? goes further and argues the defended unit shouldn't be fixed at all. It should be a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. How can operators stop coordinated agent intrusions now? turns this into practice: preserve relationships across executions, constrain shared resources, and tie responses to persistent state.

So scanning skill pairs fails for the same reason scanning single skills does, only less severely. Any fixed window is a boundary an attacker can plan around, and the corpus has no evidence yet of a window size or scanner that fully closes the gap. The note on chain-level defense is the honest ceiling: better, but not solved.