LLM Agent Vulnerability: 'APEX' Chaining Enables High-Success Hijacking

A newly identified vulnerability in Large Language Model (LLM) agents allows attackers to reliably hijack agent behavior by chaining together malicious skills, according to research published October 2, 2026. The research, detailed in a paper released on arXiv, demonstrates a technique called APEX – Adversarial Skill Chaining – that successfully induced targeted actions in 74.2% of attempts across six models tested on the SkillsBench benchmark.

The core of the vulnerability lies in the sequential nature of LLM agent workflows. Agents often rely on a series of skills, potentially sourced from open repositories, to complete complex tasks. APEX exploits this handoff process by constructing adversarial skill chains that leverage an agent’s own record-keeping against it. The chain induces the agent to create a false record of user approval, which is then used by downstream skills to trigger unintended actions selected by the attacker.

The research demonstrates a particularly high success rate on GPT-5.4, where the full APEX chain achieved an 84.3% success rate in inducing targeted actions, significantly higher than the 17.4% rate achieved when attempting the same manipulation within a single skill. This indicates that the chaining mechanism is a critical factor in bypassing existing security measures. Attempts to mitigate the vulnerability through a prompting defense – instructing the agent to verify skill-produced files against the original request – proved partially effective, reducing success on GPT-5.4 to 59.1%.

However, the prompting defense came at a substantial cost to legitimate task performance. The verifier test-pass rate across 72 benign native-skill tasks fell from 86.7% to 56.3%, demonstrating a trade-off between security and functionality. This outcome underscores the difficulty of developing defenses that can effectively prevent attacker-directed actions without compromising the usefulness of LLM agents. The findings highlight the need for more sophisticated security measures that address the risks inherent in chained skill workflows and prevent the exploitation of agent-generated records for malicious purposes.