CoSA
A privilege-escalation attack method targeting LLM agent skill composition. It injects a small number of newly admitted local skills into the skill pool and exploits cross-skill dependencies to trigger policy violations within existing runtime permissions, without modifying existing skills or permissions.
Timeline (last 90 days)
The core ideas of CoSA include capability supplementation (filling in missing business operations) and relationship reshaping (changing artifact exchange, decision reuse, and goal/action binding).
In tests across five LLMs and three Agent harnesses, with newly added Skills capped at only 5% of each original pool, the policy violation rate rose from 35.02% to 58.45%, an increase of 23.43 percentage points.
Trajectory analysis explicitly links the transition from compliance to violation to cross-Skill dependencies involving the newly added Skills.
Traditional permission checks typically target a single action or a single Skill rather than cross-Skill information flow and authorization propagation, so static compliance of runtime permissions does not equal compositional safety, and a dynamic, cross-boundary authorization verification mechanism needs to be introduced.
All Facts (4)
The core ideas of CoSA include capability supplementation (filling in missing business operations) and relationship reshaping (changing artifact exchange, decision reuse, and goal/action binding).
50%UnverifiedIn tests across five LLMs and three Agent harnesses, with newly added Skills capped at only 5% of each original pool, the policy violation rate rose from 35.02% to 58.45%, an increase of 23.43 percentage points.
50%UnverifiedTrajectory analysis explicitly links the transition from compliance to violation to cross-Skill dependencies involving the newly added Skills.
50%UnverifiedTraditional permission checks typically target a single action or a single Skill rather than cross-Skill information flow and authorization propagation, so static compliance of runtime permissions does not equal compositional safety, and a dynamic, cross-boundary authorization verification mechanism needs to be introduced.
50%