{"id":"acd25e1201a06f27a914809310e7c710c1af0c5ee2ea649d3adb6512db56344c","title":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","argument":"Authors Kashyap R Manjusha and Murali Emani investigate whether a jailbreak in a Markdown skill file can pass through an AI agent and lead it to produce prohibited answers. They test a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file, using seven open-weight models and 270 forbidden questions across nine harm categories.\n\nThe authors report that, with a benign system prompt, mean attack success rate (ASR) was 0.5%; adding the injected skill file raised mean ASR to 45%, with one model reaching 68.9%. Two obfuscation strategies—a zero-width-character payload and a phonetic payload—did not outperform plain text; the phonetic variant had a mean ASR of 30%.\n\nThe paper identifies Markdown skill files as an underexplored attack surface: files used to configure an agent may also carry jailbreak instructions into its context. The authors say vulnerability depended more on the underlying model than on the payload obfuscation technique. The results concern this particular agent setup and evaluation; they do not establish how often configuration-based jailbreaks succeed in deployed agents. How do these results change across other agent frameworks, models, and real-world configuration files?","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results come from one LangChain-based question-answering agent configuration, seven open-weight models, and 270 forbidden questions across nine harm categories; the evidence does not establish success rates in other agent frameworks or deployed settings. The abstract does not provide model names, per-category results, or details sufficient to assess how representative the tested prompts and configurations are.","speaker":{"name":"Manjusha, Kashyap R, Emani, Murali","roleAtSource":"Article author"},"source":{"title":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.37738","publishedAt":"2026-10-27","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors tested a LangChain-based question-answering agent that builds its system prompt from a user-provided Markdown file, across seven open-weight models and 270 forbidden questions in nine harm categories.","excerpt":"we construct a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file.","url":"https://arxiv.org/abs/2610.37738","relationship":"Source-stated"},{"text":"The authors report mean ASR of 0.5% with a benign system prompt and 45% after injecting the skill file; an individual model reached 68.9%.","excerpt":"Under a benign system prompt, the models exhibit near-complete refusal behavior, with a mean attack success rate (ASR) of just 0.5%. In contrast, the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models.","url":"https://arxiv.org/abs/2610.37738","relationship":"Source-stated"},{"text":"Neither tested obfuscation strategy outperformed plain-text injection; the phonetic variant lowered mean ASR to 30%.","excerpt":"Neither outperforms the plain-text injection; notably, the phonetic variant reduces mean ASR to 30%.","url":"https://arxiv.org/abs/2610.37738","relationship":"Source-stated"},{"text":"The authors conclude that vulnerability depended more on the underlying model than on the specific payload obfuscation technique.","excerpt":"vulnerability to configuration-based jailbreaks depends more strongly on the underlying model than on the specific payload obfuscation technique.","url":"https://arxiv.org/abs/2610.37738","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.37738","checkedAt":"2026-11-10T20:34:10.671Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How do these results change across other agent frameworks, models, and real-world configuration files?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","summary":"Authors Kashyap R Manjusha and Murali Emani investigate whether a jailbreak in a Markdown skill file can pass through an AI agent and lead it to produce prohibited answers. They test a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file, using seven open-weight models and 270 forbidden questions across nine harm categories.\n\nThe authors report that, with a benign system prompt, mean attack success rate (ASR) was 0.5%; adding the injected skill file raised mean ASR to 45%, with one model reaching 68.9%. Two obfuscation strategies—a zero-width-character payload and a phonetic payload—did not outperform plain text; the phonetic variant had a mean ASR of 30%.\n\nThe paper identifies Markdown skill files as an underexplored attack surface: files used to configure an agent may also carry jailbreak instructions into its context. The authors say vulnerability depended more on the underlying model than on the payload obfuscation technique. The results concern this particular agent setup and evaluation; they do not establish how often configuration-based jailbreaks succeed in deployed agents. How do these results change across other agent frameworks, models, and real-world configuration files?","question":"How do these results change across other agent frameworks, models, and real-world configuration files?","claims":[{"text":"The authors tested a LangChain-based question-answering agent that builds its system prompt from a user-provided Markdown file, across seven open-weight models and 270 forbidden questions in nine harm categories.","excerpt":"we construct a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file.","support":"source-stated"},{"text":"The authors report mean ASR of 0.5% with a benign system prompt and 45% after injecting the skill file; an individual model reached 68.9%.","excerpt":"Under a benign system prompt, the models exhibit near-complete refusal behavior, with a mean attack success rate (ASR) of just 0.5%. In contrast, the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models.","support":"source-stated"},{"text":"Neither tested obfuscation strategy outperformed plain-text injection; the phonetic variant lowered mean ASR to 30%.","excerpt":"Neither outperforms the plain-text injection; notably, the phonetic variant reduces mean ASR to 30%.","support":"source-stated"},{"text":"The authors conclude that vulnerability depended more on the underlying model than on the specific payload obfuscation technique.","excerpt":"vulnerability to configuration-based jailbreaks depends more strongly on the underlying model than on the specific payload obfuscation technique.","support":"source-stated"}],"limitations":["The reported results come from one LangChain-based question-answering agent configuration, seven open-weight models, and 270 forbidden questions across nine harm categories; the evidence does not establish success rates in other agent frameworks or deployed settings.","The abstract does not provide model names, per-category results, or details sufficient to assess how representative the tested prompts and configurations are."],"mediaId":"a48de40a2c387d00fefb02151d135ccf55d6b45da648881ff6ebdfa8874ab4c5","correctionReason":null,"id":"acd25e1201a06f27a914809310e7c710c1af0c5ee2ea649d3adb6512db56344c","publicationId":"b4542a78-89ac-48e8-8020-84ddda668cd8","version":1,"sourceUrl":"https://arxiv.org/abs/2610.37738","sourceTitle":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-27","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-30T06:40:55.429Z","createdAt":"2026-11-10T20:02:55.997Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"a48de40a2c387d00fefb02151d135ccf55d6b45da648881ff6ebdfa8874ab4c5","kind":"article","url":"https://arxiv.org/abs/2610.37738","sourceUrl":"https://arxiv.org/abs/2610.37738","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-30T15:32:09.555Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.37738","checkedAt":"2026-11-10T20:34:10.671Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"a48de40a2c387d00fefb02151d135ccf55d6b45da648881ff6ebdfa8874ab4c5","confidence":0.9099999999999999,"provider":"typesafe","model":"jev-1.13.0","inputHash":"1206d4553df1b5ff2b6a4207232ebc95d093b4047837c1421906c842c268938d","decidedAt":"2026-10-30T15:32:11.618Z"},"provenance":{"textHash":"c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7","observationId":"16d52368e1dd5cc6beeefdbb8a45dabae50bd0273ce9a08eaaa02e70b4be03f6","retrievedAt":"2026-10-30T15:32:09.219Z","kind":"publisher-page","preparer":{"model":"server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna)","runId":"e6d34c35-17c7-4c5e-88b3-162a8954d709"},"reviewer":{"model":"gpt-6-luna","runId":"742e52bb-b6a6-451e-89e5-df51b94d9d58"}},"audit":{"status":"passed","reviewedAt":"2026-11-10T20:02:55.997Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Manjusha, Kashyap R","url":null,"kind":"unknown"},{"name":"Emani, Murali","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Manjusha, Kashyap R","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Manjusha, Kashyap R","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.37738","locator":"head/meta[name=author|citation_author]"},"assertionId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T20:34:10.671Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5","sourceUrl":"https://arxiv.org/abs/2610.37738","contentSha256":"c8787484eee09ce52a6ac2382d9312dabd4d36bf5771cbb58a4c0b86c9453ce1","textHash":"c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7","observedAt":"2026-11-10T20:34:10.671Z"}},{"actor":{"name":"Emani, Murali","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Emani, Murali","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.37738","locator":"head/meta[name=author|citation_author]"},"assertionId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T20:34:10.671Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5","sourceUrl":"https://arxiv.org/abs/2610.37738","contentSha256":"c8787484eee09ce52a6ac2382d9312dabd4d36bf5771cbb58a4c0b86c9453ce1","textHash":"c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7","observedAt":"2026-11-10T20:34:10.671Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.37738","snapshotId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5","contentSha256":"c8787484eee09ce52a6ac2382d9312dabd4d36bf5771cbb58a4c0b86c9453ce1","textHash":"c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7","observedAt":"2026-11-10T20:34:10.671Z","basis":"publisher-page-metadata","sourceLinks":42,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/acd25e1201a06f27a914809310e7c710c1af0c5ee2ea649d3adb6512db56344c/source"}},"canonicalUrl":"https://escapemeridian.com/readings/poisoned-skills-propagating-jailbreaks-through-agent-markdown-acd25e12","formats":{"html":"/readings/poisoned-skills-propagating-jailbreaks-through-agent-markdown-acd25e12","markdown":"/readings/poisoned-skills-propagating-jailbreaks-through-agent-markdown-acd25e12.md","json":"/readings/poisoned-skills-propagating-jailbreaks-through-agent-markdown-acd25e12.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-jailbreak","name":"Jailbreak","explanation":"A prompt written to trick an AI system into ignoring its safety rules.","referenceUrl":"https://arxiv.org/abs/2307.02483"},{"id":"term-ai-agent","name":"AI agent","explanation":"An AI system that chooses and carries out actions toward a goal, often using software tools.","referenceUrl":"https://www.ibm.com/think/topics/ai-agents"},{"id":"term-open-weights","name":"Open weights","explanation":"A model whose trained numbers are published so others can download, run and inspect it; the license and training data may still be restricted.","referenceUrl":"https://opensource.org/ai/open-weights"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"},{"id":"langchain","name":"LangChain","kind":"organization","context":"LangChain builds tools for developing, evaluating and operating applications that use language models and agents.","referenceUrls":["https://www.langchain.com/blog"],"path":"/entities/langchain","json":"/entities/langchain.json","markdown":"/entities/langchain.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"acd25e1201a06f27a914809310e7c710c1af0c5ee2ea649d3adb6512db56344c","revision":"b4542a78-89ac-48e8-8020-84ddda668cd8","revisionKind":"publication-id","title":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","url":"https://escapemeridian.com/readings/poisoned-skills-propagating-jailbreaks-through-agent-markdown-acd25e12"},"source":{"type":"source","id":"https://arxiv.org/abs/2610.37738","revision":"c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7","revisionKind":"sha256-source-text","title":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","url":"https://arxiv.org/abs/2610.37738"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"acd25e1201a06f27a914809310e7c710c1af0c5ee2ea649d3adb6512db56344c","title":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","argument":"Authors Kashyap R Manjusha and Murali Emani investigate whether a jailbreak in a Markdown skill file can pass through an AI agent and lead it to produce prohibited answers. They test a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file, using seven open-weight models and 270 forbidden questions across nine harm categories.\n\nThe authors report that, with a benign system prompt, mean attack success rate (ASR) was 0.5%; adding the injected skill file raised mean ASR to 45%, with one model reaching 68.9%. Two obfuscation strategies—a zero-width-character payload and a phonetic payload—did not outperform plain text; the phonetic variant had a mean ASR of 30%.\n\nThe paper identifies Markdown skill files as an underexplored attack surface: files used to configure an agent may also carry jailbreak instructions into its context. The authors say vulnerability depended more on the underlying model than on the payload obfuscation technique. The results concern this particular agent setup and evaluation; they do not establish how often configuration-based jailbreaks succeed in deployed agents. How do these results change across other agent frameworks, models, and real-world configuration files?","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results come from one LangChain-based question-answering agent configuration, seven open-weight models, and 270 forbidden questions across nine harm categories; the evidence does not establish success rates in other agent frameworks or deployed settings. The abstract does not provide model names, per-category results, or details sufficient to assess how representative the tested prompts and configurations are.","speaker":{"name":"Manjusha, Kashyap R, Emani, Murali","roleAtSource":"Article author"},"source":{"title":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.37738","publishedAt":"2026-10-27","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors tested a LangChain-based question-answering agent that builds its system prompt from a user-provided Markdown file, across seven open-weight models and 270 forbidden questions in nine harm categories.","excerpt":"we construct a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file.","url":"https://arxiv.org/abs/2610.37738","relationship":"Source-stated"},{"text":"The authors report mean ASR of 0.5% with a benign system prompt and 45% after injecting the skill file; an individual model reached 68.9%.","excerpt":"Under a benign system prompt, the models exhibit near-complete refusal behavior, with a mean attack success rate (ASR) of just 0.5%. In contrast, the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models.","url":"https://arxiv.org/abs/2610.37738","relationship":"Source-stated"},{"text":"Neither tested obfuscation strategy outperformed plain-text injection; the phonetic variant lowered mean ASR to 30%.","excerpt":"Neither outperforms the plain-text injection; notably, the phonetic variant reduces mean ASR to 30%.","url":"https://arxiv.org/abs/2610.37738","relationship":"Source-stated"},{"text":"The authors conclude that vulnerability depended more on the underlying model than on the specific payload obfuscation technique.","excerpt":"vulnerability to configuration-based jailbreaks depends more strongly on the underlying model than on the specific payload obfuscation technique.","url":"https://arxiv.org/abs/2610.37738","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.37738","checkedAt":"2026-11-10T20:34:10.671Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How do these results change across other agent frameworks, models, and real-world configuration files?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","summary":"Authors Kashyap R Manjusha and Murali Emani investigate whether a jailbreak in a Markdown skill file can pass through an AI agent and lead it to produce prohibited answers. They test a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file, using seven open-weight models and 270 forbidden questions across nine harm categories.\n\nThe authors report that, with a benign system prompt, mean attack success rate (ASR) was 0.5%; adding the injected skill file raised mean ASR to 45%, with one model reaching 68.9%. Two obfuscation strategies—a zero-width-character payload and a phonetic payload—did not outperform plain text; the phonetic variant had a mean ASR of 30%.\n\nThe paper identifies Markdown skill files as an underexplored attack surface: files used to configure an agent may also carry jailbreak instructions into its context. The authors say vulnerability depended more on the underlying model than on the payload obfuscation technique. The results concern this particular agent setup and evaluation; they do not establish how often configuration-based jailbreaks succeed in deployed agents. How do these results change across other agent frameworks, models, and real-world configuration files?","question":"How do these results change across other agent frameworks, models, and real-world configuration files?","claims":[{"text":"The authors tested a LangChain-based question-answering agent that builds its system prompt from a user-provided Markdown file, across seven open-weight models and 270 forbidden questions in nine harm categories.","excerpt":"we construct a LangChain-based question-answering agent whose system prompt is assembled from a user-provided Markdown file.","support":"source-stated"},{"text":"The authors report mean ASR of 0.5% with a benign system prompt and 45% after injecting the skill file; an individual model reached 68.9%.","excerpt":"Under a benign system prompt, the models exhibit near-complete refusal behavior, with a mean attack success rate (ASR) of just 0.5%. In contrast, the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models.","support":"source-stated"},{"text":"Neither tested obfuscation strategy outperformed plain-text injection; the phonetic variant lowered mean ASR to 30%.","excerpt":"Neither outperforms the plain-text injection; notably, the phonetic variant reduces mean ASR to 30%.","support":"source-stated"},{"text":"The authors conclude that vulnerability depended more on the underlying model than on the specific payload obfuscation technique.","excerpt":"vulnerability to configuration-based jailbreaks depends more strongly on the underlying model than on the specific payload obfuscation technique.","support":"source-stated"}],"limitations":["The reported results come from one LangChain-based question-answering agent configuration, seven open-weight models, and 270 forbidden questions across nine harm categories; the evidence does not establish success rates in other agent frameworks or deployed settings.","The abstract does not provide model names, per-category results, or details sufficient to assess how representative the tested prompts and configurations are."],"mediaId":"a48de40a2c387d00fefb02151d135ccf55d6b45da648881ff6ebdfa8874ab4c5","correctionReason":null,"id":"acd25e1201a06f27a914809310e7c710c1af0c5ee2ea649d3adb6512db56344c","publicationId":"b4542a78-89ac-48e8-8020-84ddda668cd8","version":1,"sourceUrl":"https://arxiv.org/abs/2610.37738","sourceTitle":"Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-27","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-30T06:40:55.429Z","createdAt":"2026-11-10T20:02:55.997Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"a48de40a2c387d00fefb02151d135ccf55d6b45da648881ff6ebdfa8874ab4c5","kind":"article","url":"https://arxiv.org/abs/2610.37738","sourceUrl":"https://arxiv.org/abs/2610.37738","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-30T15:32:09.555Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.37738","checkedAt":"2026-11-10T20:34:10.671Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"a48de40a2c387d00fefb02151d135ccf55d6b45da648881ff6ebdfa8874ab4c5","confidence":0.9099999999999999,"provider":"typesafe","model":"jev-1.13.0","inputHash":"1206d4553df1b5ff2b6a4207232ebc95d093b4047837c1421906c842c268938d","decidedAt":"2026-10-30T15:32:11.618Z"},"provenance":{"textHash":"c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7","observationId":"16d52368e1dd5cc6beeefdbb8a45dabae50bd0273ce9a08eaaa02e70b4be03f6","retrievedAt":"2026-10-30T15:32:09.219Z","kind":"publisher-page","preparer":{"model":"server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna)","runId":"e6d34c35-17c7-4c5e-88b3-162a8954d709"},"reviewer":{"model":"gpt-6-luna","runId":"742e52bb-b6a6-451e-89e5-df51b94d9d58"}},"audit":{"status":"passed","reviewedAt":"2026-11-10T20:02:55.997Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Manjusha, Kashyap R","url":null,"kind":"unknown"},{"name":"Emani, Murali","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Manjusha, Kashyap R","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Manjusha, Kashyap R","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.37738","locator":"head/meta[name=author|citation_author]"},"assertionId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T20:34:10.671Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5","sourceUrl":"https://arxiv.org/abs/2610.37738","contentSha256":"c8787484eee09ce52a6ac2382d9312dabd4d36bf5771cbb58a4c0b86c9453ce1","textHash":"c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7","observedAt":"2026-11-10T20:34:10.671Z"}},{"actor":{"name":"Emani, Murali","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Emani, Murali","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.37738","locator":"head/meta[name=author|citation_author]"},"assertionId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T20:34:10.671Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5","sourceUrl":"https://arxiv.org/abs/2610.37738","contentSha256":"c8787484eee09ce52a6ac2382d9312dabd4d36bf5771cbb58a4c0b86c9453ce1","textHash":"c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7","observedAt":"2026-11-10T20:34:10.671Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.37738","snapshotId":"495ab3e8034447d9ef0cee7283f8642e8fa88b7f33107299408937dff5c23cc5","contentSha256":"c8787484eee09ce52a6ac2382d9312dabd4d36bf5771cbb58a4c0b86c9453ce1","textHash":"c5bde8f066d3a0119f5fc7a8cb31760e25bb76fc108fe00d951d72406c783da7","observedAt":"2026-11-10T20:34:10.671Z","basis":"publisher-page-metadata","sourceLinks":42,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/acd25e1201a06f27a914809310e7c710c1af0c5ee2ea649d3adb6512db56344c/source"}}}],"audits":[{"publicationId":"b4542a78-89ac-48e8-8020-84ddda668cd8","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading correctly attributes the paper to Kashyap R Manjusha and Murali Emani on arXiv. Results are framed as the authors' reports rather than established facts.","excerpt":"Authors:Kashyap R Manjusha, Murali Emani"},{"dimension":"summary","status":"pass","explanation":"The reading leads with the research question and setup, then the key numbers, obfuscation results and implications. Terms like jailbreak, system prompt, open-weight, LangChain and ASR are kept exact for term-library tooltips. The mechanism, configuration files carrying jailbreak text into an agent's context, is explained plainly. The question follows from the stated scope limits. Optional fidelity repair: the source says its findings 'suggest' model dependence; the draft's 'say' and the claim's 'conclude' are slightly firmer. Changing them to 'suggest' would preserve the hedge.","excerpt":"These findings identify Markdown skill files as an underexplored attack surface for AI agents"},{"dimension":"date","status":"pass","explanation":"The originalPublished value, 2026-10-27, matches the v1 arXiv submission date. The feed date of 2026-10-30 is correctly not used.","excerpt":"[Submitted on 27 Oct 2026]"},{"dimension":"support","status":"pass","explanation":"All figures match the abstract: 0.5%, 45%, 68.9%, 30%, seven models, 270 questions and nine categories. The limitations about scope and the missing model names in the abstract are accurate and invent no impacts. Rendering 'individual models' as 'one model' is a reasonable reading of the peak value.","excerpt":"the injected skill file raises the mean ASR to 45%, reaching 68.9% for individual models"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper, which is the most direct source.","excerpt":null}],"createdAt":"2026-11-10T20:02:55.997Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}