Manjusha, Kashyap R, Emani, Murali · Oct 27, 2026
Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files
Markdown · JSON · Original source
Authors Kashyap R Manjusha and Murali Emani investigate whether a in a Markdown skill file can pass through an and lead it to produce prohibited answers. They test a -based question-answering agent whose system prompt is assembled from a user-provided Markdown file, using seven and 270 forbidden questions across nine harm categories. The authors report that, with a benign system prompt, mean attack success rate (ASR) was 0.5%; adding the injected skill file raised mean ASR to 45%, with one model reaching 68.9%. Two obfuscation strategies—a zero-width-character payload and a phonetic payload—did not outperform plain text; the phonetic variant had a mean ASR of 30%. The paper identifies Markdown skill files as an underexplored attack surface: files used to configure an agent may also carry jailbreak instructions into its context. The authors say vulnerability depended more on the underlying model than on the payload obfuscation technique. The results concern this particular agent setup and evaluation; they do not establish how often configuration-based jailbreaks succeed in deployed agents. How do these results change across other agent frameworks, models, and real-world configuration files?
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Oct 27, 2026 (2026-10-27).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-10T20:02:55.997Z. First observed: 2026-10-30T06:40:55.429Z. Retrieved: 2026-10-30T15:32:09.219Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The reported results come from one -based question-answering agent configuration, seven , and 270 forbidden questions across nine harm categories; the evidence does not establish success rates in other agent frameworks or deployed settings. The abstract does not provide model names, per-category results, or details sufficient to assess how representative the tested prompts and configurations are.
Open question
How do these results change across other agent frameworks, models, and real-world configuration files?
Source-stated
The authors tested a LangChain-based question-answering agent that builds its system prompt from a user-provided Markdown file, across seven open-weight models and 270 forbidden questions in nine harm categories.
we construct a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file.
Source-stated
The authors report mean ASR of 0.5% with a benign system prompt and 45% after injecting the skill file; an individual model reached 68.9%.
Under a benign system prompt, the models exhibit near-complete refusal behavior, with a mean attack success rate (ASR) of just 0.5%. In contrast, the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models.
Source-stated
Neither tested obfuscation strategy outperformed plain-text injection; the phonetic variant lowered mean ASR to 30%.
Neither outperforms the plain-text injection; notably, the phonetic variant reduces mean ASR to 30%.
Source-stated
The authors conclude that vulnerability depended more on the underlying model than on the specific payload obfuscation technique.
vulnerability to configuration-based jailbreaks depends more strongly on the underlying model than on the specific payload obfuscation technique.
Source and contributor context
Manjusha, Kashyap R, Emani, Murali · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Jailbreak
A prompt written to trick an AI system into ignoring its safety rules.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Open weights
A model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
LangChain
LangChain builds tools for developing, evaluating and operating applications that use language models and agents.
Editorial provenance
Version 1. Publication ID: b4542a78-89ac-48e8-8020-84ddda668cd8.
Prepared by server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna); grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-10T20:02:55.997Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 16d52368e1dd5cc6beeefdbb8a45dabae50bd0273ce9a08eaaa02e70b4be03f6. Source text hash: c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7.
Revision and source-check history
Version 1 · 2026-11-10T20:02:55.997Z
Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files
Authors Kashyap R Manjusha and Murali Emani investigate whether a in a Markdown skill file can pass through an and lead it to produce prohibited answers. They test a -based question-answering agent whose system prompt is assembled from a user-provided Markdown file, using seven and 270 forbidden questions across nine harm categories. The authors report that, with a benign system prompt, mean attack success rate (ASR) was 0.5%; adding the injected skill file raised mean ASR to 45%, with one model reaching 68.9%. Two obfuscation strategies—a zero-width-character payload and a phonetic payload—did not outperform plain text; the phonetic variant had a mean ASR of 30%. The paper identifies Markdown skill files as an underexplored attack surface: files used to configure an agent may also carry jailbreak instructions into its context. The authors say vulnerability depended more on the underlying model than on the payload obfuscation technique. The results concern this particular agent setup and evaluation; they do not establish how often configuration-based jailbreaks succeed in deployed agents. How do these results change across other agent frameworks, models, and real-world configuration files?
Original source
cs.AI · Article
Source details
Original source date: Oct 27, 2026 (2026-10-27).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-10T20:02:55.997Z. First observed: 2026-10-30T06:40:55.429Z. Retrieved: 2026-10-30T15:32:09.219Z.
Limits
The reported results come from one -based question-answering agent configuration, seven , and 270 forbidden questions across nine harm categories; the evidence does not establish success rates in other agent frameworks or deployed settings. The abstract does not provide model names, per-category results, or details sufficient to assess how representative the tested prompts and configurations are.
Open question
How do these results change across other agent frameworks, models, and real-world configuration files?
Source-stated
The authors tested a LangChain-based question-answering agent that builds its system prompt from a user-provided Markdown file, across seven open-weight models and 270 forbidden questions in nine harm categories.
we construct a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file.
Source-stated
The authors report mean ASR of 0.5% with a benign system prompt and 45% after injecting the skill file; an individual model reached 68.9%.
Under a benign system prompt, the models exhibit near-complete refusal behavior, with a mean attack success rate (ASR) of just 0.5%. In contrast, the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models.
Source-stated
Neither tested obfuscation strategy outperformed plain-text injection; the phonetic variant lowered mean ASR to 30%.
Neither outperforms the plain-text injection; notably, the phonetic variant reduces mean ASR to 30%.
Source-stated
The authors conclude that vulnerability depended more on the underlying model than on the specific payload obfuscation technique.
vulnerability to configuration-based jailbreaks depends more strongly on the underlying model than on the specific payload obfuscation technique.
Source and contributor context
Manjusha, Kashyap R, Emani, Murali · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Jailbreak
A prompt written to trick an AI system into ignoring its safety rules.
AI agent
An AI system that chooses and carries out actions toward a goal, often using software tools.
Open weights
A model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
LangChain
LangChain builds tools for developing, evaluating and operating applications that use language models and agents.
Editorial provenance
Version 1. Publication ID: b4542a78-89ac-48e8-8020-84ddda668cd8.
Prepared by server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna); grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-10T20:02:55.997Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 16d52368e1dd5cc6beeefdbb8a45dabae50bd0273ce9a08eaaa02e70b4be03f6. Source text hash: c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7.
passed · 2026-11-10T20:02:55.997Z · anthropic/claude-opus-5.5
Publication: b4542a78-89ac-48e8-8020-84ddda668cd8
attribution — pass: The reading correctly attributes the paper to Kashyap R Manjusha and Murali Emani on arXiv. Results are framed as the authors' reports rather than established facts.
Authors:Kashyap R Manjusha, Murali Emani
summary — pass: The reading leads with the research question and setup, then the key numbers, obfuscation results and implications. Terms like jailbreak, system prompt, open-weight, LangChain and ASR are kept exact for term-library tooltips. The mechanism, configuration files carrying jailbreak text into an agent's context, is explained plainly. The question follows from the stated scope limits. Optional fidelity repair: the source says its findings 'suggest' model dependence; the draft's 'say' and the claim's 'conclude' are slightly firmer. Changing them to 'suggest' would preserve the hedge.
These findings identify Markdown skill files as an underexplored attack surface for AI agents
date — pass: The originalPublished value, 2026-10-27, matches the v1 arXiv submission date. The feed date of 2026-10-30 is correctly not used.
[Submitted on 27 Oct 2026]
support — pass: All figures match the abstract: 0.5%, 45%, 68.9%, 30%, seven models, 270 questions and nine categories. The limitations about scope and the missing model names in the abstract are accurate and invent no impacts. Rendering 'individual models' as 'one model' is a reasonable reading of the peak value.
the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models
media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
A prompt written to trick an AI system into ignoring its safety rules.
Definition referenceAn AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceLangChain builds tools for developing, evaluating and operating applications that use language models and agents.
Explore LangChainA model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivLangChain builds tools for developing, evaluating and operating applications that use language models and agents.
Explore LangChainA model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
Definition referenceA prompt written to trick an AI system into ignoring its safety rules.
Definition referenceAn AI system that chooses and carries out actions toward a goal, often using software tools.
Definition referenceLangChain builds tools for developing, evaluating and operating applications that use language models and agents.
Explore LangChainA model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivLangChain builds tools for developing, evaluating and operating applications that use language models and agents.
Explore LangChainA model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.
Definition reference