Blog · arXiv Analysis · Published: August 12, 2026 · Modified: August 12, 2026 · Last reviewed: August 12, 2026

The Correct Answer Becomes the Cost Alibi

An agent can return the requested result while taking an attacker-shaped route through unnecessary skills, tokens, and time.

A new security study makes that possibility measurable. Its central warning is simple: task completion can certify the destination while concealing who chose the road and who paid for the detour.

The Paper

The source is Junliang Liu, Ruoyu Li, Wenxin Tang, Jingyu Xiao, Zhenyu Liu, Jingheng Xu, and Laizhong Cui's Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents, arXiv:2608.12273v1 [cs.CR], cross-listed in cs.AI and submitted August 12, 2026. It is a controlled security experiment, not evidence that this attack has been observed in a production deployment.

Two Gates, One Static Skill

In the paper's progressive-disclosure model, a router first sees brief, publisher-controlled skill descriptions. It loads the full instruction bodies only after choosing relevant skills. The separation saves context, but gives an untrusted publisher two linked influence points: metadata can win selection, then the body can shape planning.

Convergent Detour Hijacking couples those points. One static coordinator skill presents itself as relevant without replacing the legitimate skills. Once loaded, it frames extra native-skill calls as plausible prerequisites or checks, follows a bounded detour, and returns control to the original task. The paper's attacker does not alter the platform, inspect model internals or private prompts, supply executable payloads, control runtime responses, or interact after publication. The manipulation is fixed natural-language content.

The Evidence Design

The testbed uses OpenClaw version 2026.5.7 and its default registry of 53 skills, which the authors arranged into nine functional groups. GPT-5.5 assisted task generation. Of 536 multi-skill tasks, 45 were reserved for coordinator development and 491 were held out for final evaluation. Clean and injected runs used matched configurations in mutually isolated sessions inside one Ubuntu virtual machine, with local mock backends.

Six model backends were tested in single-task and simulated multi-turn settings. Four experienced annotators, blinded to condition, model identity, skill traces, and resource measurements, judged completion from the request, final response, and observable artifacts. The appendix reports unanimous agreement on 96.3 percent of instances and three-to-one majority decisions on the rest.

The Result with Its Conditions

The reported results distinguish outcome from route. Across model-condition pairs, clean and injected completion rates differed by at most 1.5 percentage points. In single-task runs where the coordinator was selected and both members of the clean-injected pair completed, mean token increases ranged from 49.60 to 80.81 percent. On that same hit-and-completion-conditional basis, the average extra skill-call count across reported single-task and multi-turn configurations ranged from 1.36 to 2.20.

For DeepSeek-V4-Pro single-task runs, the coordinator hit rate was 80.02 percent; completion was 93.6 percent clean and 94.3 percent injected; and the hit-conditional mean increases were 66.91 percent for tokens, 92.45 percent for wall-clock time, and 2.20 skill calls. Those resource figures do not describe every injected run: they exclude coordinator misses and pairs in which either run failed to complete.

Latency was not uniform. One backend recorded lower wall-clock time despite substantial token growth, which the authors connect to backend-specific caching, scheduling, and inference behavior. The paper reports no uncertainty intervals or formal equivalence test for the completion comparison, so “comparable” should remain a descriptive claim rather than proof of equal completion performance.

Correctness as an Alibi

The governance problem begins when a dashboard treats a passed task as the whole security verdict. A correct final answer can hide an unnecessary route, and an invocation allowlist alone cannot show that a malicious coordinator's recruitment of otherwise benign skills was necessary. Outcome integrity and trajectory integrity are different properties.

This essay calls the correct answer a cost alibi when it ends the inquiry too early. The phrase does not imply that every long route is malicious. Legitimate work can require retries, verification, or several tools. It means that completion alone cannot establish why each transition was necessary, authorized, or proportionate to the user's objective.

A Trajectory-Necessity Receipt

This essay proposes a trajectory-necessity receipt for extensible agents. It should bind the task and registry snapshot to skill hashes and publishers; record the descriptions shown to the router, selected and loaded skills, invocation order, per-step token and time use, declared dependency for each cross-skill transition, resource caps, termination reason, final outcome, and any reviewer override.

The receipt need not expose hidden chain-of-thought or retain sensitive payloads. Structured event classes, redacted arguments, aggregate resource fields, and protected logs can preserve the audit boundary. Nor does a generated justification prove necessity. It gives a reviewer something falsifiable to compare with the task, permissions, expected path class, and resource policy.

Artifact Boundary

The paper's testbed section and artifact appendix say its benchmark, mock implementations, execution scripts, coordinator files, supplementary ZIP, and virtual-machine image are released. When reviewed, arXiv v1 exposed the PDF, HTML, and a source archive containing TeX/build material and two embedded PDFs, but no supplementary ZIP or virtual-machine image. The task records, runbooks, logs, and executable environment could therefore not be independently run for this page. All experimental numbers here remain reported paper results.

Limits That Stay Attached

The authors' limits include one agent platform, group-matched coordinators, controlled mock backends, and defenses left for future work. The benchmark is largely LLM-generated. In a separate set of 30 tasks written by three experienced users, the coordinator was selected in 10, showing both continued attack behavior and distribution sensitivity.

The paper therefore supports a narrow conclusion: under these tested configurations, successful completion did not rule out substantial, attacker-induced resource detours. It does not establish prevalence, production impact, or the effectiveness of a particular defense. Pre-installation consistency checks and runtime transition or budget controls are promising hypotheses that still require utility-aware evaluation.

Sources

Return to Blog