{"id":"https://openalex.org/W7204175486","doi":"https://doi.org/10.48550/arxiv.2608.21929","title":"SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents","display_name":"SkillBloat: Token Amplification Attacks via Skill Injection in LLM Coding Agents","publication_year":2026,"publication_date":"2026-08-22","ids":{"openalex":"https://openalex.org/W7204175486","doi":"https://doi.org/10.48550/arxiv.2608.21929"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2608.21929","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.21929","pdf_url":"https://arxiv.org/pdf/2608.21929","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.21929","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5016044907","display_name":"Yuanjin Zheng","orcid":"https://orcid.org/0000-0002-5768-367X","observed_orcids":["https://orcid.org/0000-0002-5768-367X"]},"institutions":[{"id":"https://openalex.org/I177725633","display_name":"Chinese University of Hong Kong","ror":"https://ror.org/00t33hh48","country_code":"HK","type":"education","lineage":["https://openalex.org/I177725633"]},{"id":"https://openalex.org/I4210116924","display_name":"Chinese University of Hong Kong, Shenzhen","ror":"https://ror.org/02d5ks197","country_code":"CN","type":"education","lineage":["https://openalex.org/I177725633","https://openalex.org/I180726961","https://openalex.org/I4210116924"]}],"countries":["CN","HK"],"is_corresponding":false,"raw_author_name":"Zheng, Yuanjin","raw_affiliation_strings":["CUHK-Shenzhen & SLAI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CUHK-Shenzhen & SLAI","institution_ids":["https://openalex.org/I177725633","https://openalex.org/I4210116924"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5148049931","display_name":"Jingbang Chen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I177725633","display_name":"Chinese University of Hong Kong","ror":"https://ror.org/00t33hh48","country_code":"HK","type":"education","lineage":["https://openalex.org/I177725633"]},{"id":"https://openalex.org/I4210116924","display_name":"Chinese University of Hong Kong, Shenzhen","ror":"https://ror.org/02d5ks197","country_code":"CN","type":"education","lineage":["https://openalex.org/I177725633","https://openalex.org/I180726961","https://openalex.org/I4210116924"]}],"countries":["CN","HK"],"is_corresponding":false,"raw_author_name":"Chen, Jingbang","raw_affiliation_strings":["CUHK-Shenzhen & SLAI"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CUHK-Shenzhen & SLAI","institution_ids":["https://openalex.org/I177725633","https://openalex.org/I4210116924"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9814000129699707,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9814000129699707,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.009800000116229057,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0010000000474974513,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/llm-coding-agents","display_name":"LLM coding agents","score":0.8510000109672546},{"id":"https://openalex.org/keywords/llm-security","display_name":"LLM security","score":0.5360000133514404}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7260000109672546},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.698199987411499},{"id":"https://openalex.org/C179518139","wikidata":"https://www.wikidata.org/wiki/Q5140297","display_name":"Coding (social sciences)","level":2,"score":0.5489000082015991},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5378000140190125},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.44749999046325684},{"id":"https://openalex.org/C155076860","wikidata":"https://www.wikidata.org/wiki/Q1932004","display_name":"Token economy","level":3,"score":0.4115000069141388},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.3959999978542328},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.3499999940395355},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.33469998836517334},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33390000462532043},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.3231000006198883},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.3095000088214874},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.30730000138282776},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2623000144958496}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.21929","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.21929","pdf_url":"https://arxiv.org/pdf/2608.21929","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.21929","doi":"https://doi.org/10.48550/arxiv.2608.21929","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.21929","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.21929","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.21929","pdf_url":"https://arxiv.org/pdf/2608.21929","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204175486.pdf","grobid_xml":"https://content.openalex.org/works/W7204175486.grobid-xml"},"referenced_works_count":10,"referenced_works":["https://openalex.org/W4388886073","https://openalex.org/W4405902820","https://openalex.org/W4412875463","https://openalex.org/W4412888242","https://openalex.org/W7103200659","https://openalex.org/W7124446840","https://openalex.org/W7124732130","https://openalex.org/W7129431440","https://openalex.org/W7133214447","https://openalex.org/W7150989032"],"related_works":["https://openalex.org/W7165127939","https://openalex.org/W7131420072","https://openalex.org/W7129431440","https://openalex.org/W7150989032","https://openalex.org/W7221760652","https://openalex.org/W7201848377","https://openalex.org/W7128403224","https://openalex.org/W7151909507","https://openalex.org/W7213279899","https://openalex.org/W7163907095"],"abstract_inverted_index":{"Agent":[0],"skills":[1],"extend":[2],"coding":[3],"agents":[4],"with":[5],"task-specific":[6],"instructions,":[7],"scripts,":[8],"and":[9,77],"resources,":[10],"but":[11],"they":[12],"also":[13],"create":[14],"a":[15,41,61,67,90,142],"trusted":[16],"instruction":[17],"channel":[18],"that":[19,64,108,125,138,147],"can":[20],"be":[21],"abused":[22],"beyond":[23,131],"conventional":[24],"security":[25],"attacks.":[26],"This":[27],"paper":[28],"studies":[29],"token":[30],"amplification":[31,75,99,117],"through":[32,83],"skill":[33,43,86,92,139,153],"injection:":[34],"an":[35,45],"economic":[36],"resource-abuse":[37],"threat":[38],"in":[39],"which":[40],"malicious":[42],"causes":[44],"agent":[46],"to":[47,150],"consume":[48],"substantially":[49],"more":[50],"tokens":[51],"than":[52],"needed":[53],"for":[54],"normal":[55],"task":[56],"execution.":[57],"We":[58],"present":[59],"SkillBloat,":[60],"two-phase":[62],"framework":[63],"first":[65],"screens":[66],"library":[68],"of":[69],"diverse":[70],"attack-type":[71,121,133],"conditions":[72],"across":[73,100],"multiple":[74,101],"mechanisms":[76],"then":[78],"refines":[79],"the":[80,109],"strongest":[81],"candidate":[82],"LLM-guided":[84],"full-document":[85],"rewriting.":[87],"Evaluated":[88],"on":[89],"real-world":[91],"benchmark,":[93],"SkillBloat":[94],"achieves":[95],"5.4184x-10.1455x":[96],"average":[97,115],"best":[98,116],"coding-agent":[102],"target":[103],"configurations.":[104],"An":[105],"ablation":[106],"shows":[107],"second-stage":[110],"refinement":[111],"loop":[112],"consistently":[113],"improves":[114],"over":[118],"Phase":[119],"1":[120],"screening":[122],"alone,":[123],"demonstrating":[124],"iterative":[126],"optimization":[127],"provides":[128],"additional":[129],"benefit":[130],"initial":[132],"selection.":[134],"These":[135],"results":[136],"show":[137],"ecosystems":[140],"expose":[141],"practical":[143],"resource-amplification":[144],"attack":[145],"surface":[146],"is":[148],"orthogonal":[149],"existing":[151],"security-oriented":[152],"poisoning.":[154]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-26T00:00:00"}