Skill poisoning is the manipulation of an AI agent’s learned behavior or tool selection so it performs unsafe, biased, or unintended actions. In identity security, it can corrupt agentic workflows by influencing model training, memory, prompts, or tool context, turning trusted automation into a source of unauthorized access or data exposure.
How Skill Poisoning Works
Skill poisoning targets the part of an agentic system that decides what to do next. By tampering with learned behaviour, prompt context, memory, or skill metadata, an attacker can tilt the agent toward unsafe actions without changing the surrounding application code.
This matters because the agent may still appear to be “following policy” while its internal decision path has been quietly redirected. In practice, the compromise can surface as wrong tool choice, unexpected escalation, or a trusted workflow behaving as if it had legitimate intent.
Why Skill Poisoning Is Dangerous
Skill poisoning is dangerous because it attacks the control plane of automation, not just a single prompt or one-off response. Once a poisoned skill or memory pattern is reused, the bad behaviour can recur across sessions, tasks, or users, especially when the agent relies on shared context or inherited permissions.
The most serious consequence is that apparently routine automation can become a path to unauthorised access, sensitive data exposure, or destructive side effects. The failure is often subtle: the system may still produce plausible outputs while drifting toward actions that were never truly authorised.
For a practical threat-modeling view of these failure modes, the OWASP Agentic AI Top 10 and the MITRE ATLAS adversarial AI threat matrix are useful references for how agent behaviour can be manipulated.
How Organisations Reduce Exposure
Exposure starts with where skills come from, who can change them, and how much authority the agent inherits when a skill runs. Organisations should treat skill registries, tool definitions, memory stores, and retrieval sources as security-sensitive inputs, because poisoning usually succeeds by corrupting one of those trust boundaries.
Defensive design is strongest when agent capabilities are constrained by explicit approval paths, scoped permissions, and environment separation. A poisoned skill is far less harmful when the agent cannot freely reach powerful tools, sensitive data, or privileged APIs by default.
The OWASP Agentic Skills Top 10 (AST10) is particularly relevant because it focuses on the skill layer itself, while OWASP Non-Human Identity Top 10 helps frame the downstream access risk when an agent is operating through credentials or service identities.
Detection, Review, and Recovery
Detection should look for behaviour change, not only technical compromise. A poisoned skill often shows up as unusual tool selection, unexpected context reuse, repeated attempts to reach data outside the normal task boundary, or outputs that diverge from the agent’s normal operating pattern.
After suspected poisoning, organisations should review recent prompts, memory writes, skill updates, retrieval sources, and any credentialed actions the agent took. The key question is not just whether the poisoning was removed, but whether the agent already used its trusted position to expose data or perform unauthorised actions.
Broader control mapping for this kind of monitoring aligns well with NIST SP 800-53 Rev 5 Security and Privacy Controls and the operational threat perspective in MITRE ATT&CK Enterprise Matrix.
Risk and Threat Considerations
Skill poisoning is risky because it can turn a trusted automation layer into a stealthy abuse path. The attacker does not need to break the whole system, only to bias what the agent believes is safe, useful, or permitted enough to act on.
Failure mechanism: Poisoned skills, memory, prompts, or context alter the agent’s internal decision logic, causing it to select unsafe tools, disclose data, or execute unintended actions while still appearing legitimate.
Impact: The result can include unauthorised access, data leakage, privilege misuse, and persistence of bad behaviour across repeated agent runs or shared workflows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Agentic Skills Top 10 and MITRE ATLAS define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Skill poisoning can steer agents into unsafe privilege use and unauthorized actions. |
| ASI06 — Memory & Context Poisoning | The term directly concerns corrupted memory, prompts, and context affecting agent behaviour. | |
| ASI02 — Tool Misuse | Poisoned skills can redirect an agent toward unsafe or unintended tool use. | |
| Recommendation — Constrain agent authority so poisoned behaviour cannot trigger privileged actions by default. Validate and isolate agent memory and context sources before they influence decisions. Restrict tool invocation paths and monitor for anomalous tool selection. | ||
| OWASP Agentic Skills Top 10 | AST10 — Agentic Skills Top 10 | Skill poisoning targets the skill layer, including skill registries and permission inheritance. |
| Recommendation — Assess skill provenance and control inheritance in the agent skill layer. | ||
| MITRE ATLAS | Adversarial AI techniques | ATLAS catalogs agentic AI attack patterns including context poisoning and tool misuse. |
| Recommendation — Map observed behaviour to adversarial AI techniques and hunt for manipulation patterns. | ||
Practitioner Guidance
Why practitioners should care: Skill poisoning is not just an AI quality issue, it is an access and control issue. If an agent can carry poisoned behaviour into privileged workflows, the damage can look like ordinary automation while actually bypassing human intent.
What to watch for: Pay attention to skill updates, memory changes, retrieval-source drift, and sudden shifts in tool choice or action ordering. Those are often the earliest signs that the agent’s behaviour has been influenced rather than simply mistaken.
Practitioner takeaway: Treat agent skill and context as governed security inputs, then assume that any mechanism that shapes tool choice can also shape trust.