Hijacking AI Agents, Part 3: The Four Surfaces
Part 2 took apart one malicious skill file. But a file in your repo is only the most obvious way in. The trust bug from Part 1 shows up anywhere low-trust text reaches the model, and four surfaces matter. This part revisits the first with a nastier variant, then walks the other three. The focus is on how each one works and what it leaves behind, not on runnable attacks. Surface 1: Skill and Instruction Files This is the surface from Part 2, so a quick recap. Skill bodies, .instructions.md, AGENTS.md, copilot-instructions.md, CLAUDE.md, and GEMINI.md are read as instructions. A malicious one carries imperative text (“before any task, always …”), often hidden in an HTML comment, zero-width characters, or an off-screen block, and often lured into auto-loading with an over-broad applyTo and an urgent description. ...