Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents

Direct Answer

The paper introduces Convergent Detour Hijacking (CDH), a text‑only, runtime‑independent attack that forces skill‑based LLM agents onto costly detours while still completing the original task. It matters because CDH shows that even well‑behaving agents can be steered into resource‑heavy trajectories without any overt failure, exposing a hidden cost‑security risk for production AI systems.

Background: Why This Problem Is Hard

Modern LLM agents increasingly rely on a modular “skill” ecosystem: a central planner selects third‑party capabilities via natural‑language descriptions, then hands each skill a textual instruction body for execution. This progressive‑disclosure design offers flexibility but also creates two sequential control points that untrusted publishers can abuse:

• Selection stage: The agent chooses a skill based on a short description.
• Planning stage: The chosen skill receives a detailed instruction body that may embed hidden dependencies.

Existing research has examined each stage in isolation—selection manipulation, malicious instruction payloads, or tool‑chain amplification—but has not demonstrated how an attacker can stitch them together into a seamless, end‑to‑end exploit. The difficulty lies in preserving the outward appearance of a correct task while subtly inflating token usage, latency, and monetary cost. As enterprises begin to bill LLM usage by the token or millisecond, such “silent” amplification becomes a serious operational and financial threat.

What the Researchers Propose

The authors propose a unified threat model called Convergent Detour Hijacking (CDH). CDH exploits the semantic overlap between a skill’s public description and its private instruction body to create a “semantic cover” that convinces the agent’s selector and planner that the skill is both relevant and trustworthy. The attack proceeds in three coordinated steps:

1. Description manipulation: An attacker publishes a skill whose description appears highly relevant to the target task, ensuring it is selected alongside legitimate skills.
2. Planning hijack: The same skill’s instruction body reuses the description’s rationale to fabricate plausible intermediate dependencies, pulling in additional benign skills that the attacker does not control.
3. Detour convergence: After the unnecessary sub‑tasks are executed, the attacker‑controlled coordinator steers the workflow back to the original path, preserving the final outcome while having consumed extra resources.

Key components of the CDH framework include:

• Attacker‑controlled coordinator – a skill that orchestrates the detour and re‑entry.
• Legitimate auxiliary skills – benign third‑party tools recruited unintentionally into the detour.
• Semantic cover – the overlapping language that links description and body, making the hijack indistinguishable from a normal plan.

How It Works in Practice

The following conceptual workflow illustrates a typical CDH execution against a multi‑skill LLM agent:

1. User query arrives. The agent’s selector parses the request and ranks available skills based on their natural‑language descriptions.
2. Malicious skill is selected. Because its description mirrors the user’s intent, the selector places it near the top of the ranking, often alongside a legitimate “coordinator” skill.
3. Planner generates a unified instruction body. The selected skill receives a prompt that includes the original task plus a fabricated dependency chain (e.g., “first retrieve X using Skill A, then transform with Skill B”).
4. Detour activation. The malicious skill calls the coordinator, which in turn invokes the auxiliary benign skills. Each call appears legitimate because the instruction body references the earlier description.
5. Resource amplification. Tokens are consumed by every auxiliary call, and latency accumulates as the agent waits for each sub‑task to finish.
6. Convergence. After the detour, the coordinator returns control to the original workflow, allowing the agent to produce the expected final answer.

What distinguishes CDH from prior attacks is its ability to remain “text‑only” and independent of runtime hooks. The attacker does not need to inject code or modify the agent’s runtime environment; the entire hijack is encoded in the natural‑language artifacts that the agent already trusts.

Evaluation & Results

The researchers evaluated CDH on four LLM backends (including DeepSeek‑V4‑Pro) across 491 held‑out tasks spanning single‑turn and multi‑turn interactions. Their methodology involved:

• Creating a pool of 120 malicious skills with carefully crafted descriptions.
• Embedding each skill into a realistic orchestration pipeline that also contained 30 legitimate skills.
• Measuring three primary outcomes: coordinator selection rate, token overhead, and end‑to‑end execution time.

Key findings include:

• High coordinator hit rate: On DeepSeek‑V4‑Pro, the attacker‑controlled coordinator was selected in 80.02 % of tasks.
• Significant resource amplification: For runs where the coordinator was hit and the task still completed, token consumption rose by 66.91 % and total execution time increased by 92.45 %.
• Task success unchanged: Despite the inflated cost, the overall task‑completion rate remained comparable to baseline runs, confirming that CDH preserves functional correctness.

These results demonstrate that CDH can silently inflate operational costs while delivering the same user‑visible outcome—a scenario that would evade traditional success‑rate‑only monitoring.

Why This Matters for AI Systems and Agents

For practitioners building production‑grade AI agents, CDH raises three immediate concerns:

1. Cost safety. Cloud providers charge per token and per millisecond; a hidden 70 % token increase can translate into substantial budget overruns.
2. Security posture. The attack does not rely on code execution, making it invisible to conventional sandboxing or static analysis tools.
3. Trust in skill marketplaces. Organizations that source third‑party skills from open repositories must now consider semantic manipulation as a vector, not just malicious binaries.

Mitigation strategies emerging from the paper include:

• Cross‑checking skill descriptions against their instruction bodies using a secondary LLM verifier.
• Limiting the depth of skill‑chaining and enforcing explicit cost caps per workflow.
• Maintaining provenance metadata for each skill and rejecting those without verified publisher identities.

UBOS’s Enterprise AI platform by UBOS already offers built‑in provenance tracking and cost‑monitoring dashboards that can be extended to flag anomalous detours. Additionally, the Workflow automation studio lets developers visualize skill dependencies, making it easier to spot unexpected branches introduced by a CDH‑style attack.

What Comes Next

While the CDH study provides a compelling proof‑of‑concept, several open challenges remain:

• Generalization to multimodal agents. The current attack focuses on pure‑text pipelines; extending it to vision‑language or audio‑language agents may require new semantic cover techniques.
• Dynamic skill repositories. Real‑world systems continuously ingest new skills; automated detection of description‑body alignment drift is an unsolved problem.
• Human‑in‑the‑loop verification. Designing UI cues that alert operators to unusually long skill chains without overwhelming them is an area for UX research.

Future research could explore adversarial training regimes that teach agents to recognize “detour patterns,” or develop cryptographic attestation mechanisms for skill provenance. From an industry perspective, integrating CDH‑aware safeguards into orchestration layers—such as the OpenAI ChatGPT integration or the ChatGPT and Telegram integration—will help enterprises adopt LLM agents with confidence.

For a deeper dive into the original research, see the Convergent Detour Hijacking paper on arXiv.