Daydreaming: Stealing Hidden Agent Skills through Black-Box Task Interaction
Yu-Lin Tsai and co-authors (NYCU, Berkeley) present Daydreaming, an execution-only attack that reconstructs a hosted multi-file agent skill purely by submitting the ordinary tasks the service exists to perform.
Ask this paper
The defense being bypassed: Providers keep skill files secret while selling task results. Disclosure defenses can block requests that ask for the skill or reproduce its text; they cannot block a paying customer from asking for normal work.
86.8% capability recovery at the weakest access level: Under the Output threat level, where the attacker sees only the final response and returned files, Daydreaming recovers 86.8% of the skill's capability across 7 skills and 4 victim models, roughly 4x SigLeak.
32 victim calls, median: It produces installable skills at a median of 32 calls per skill even with disclosure defenses enabled, using attacker-controlled shadow agents to pick a design and local execution checks to complete each file.
Three formalized threat levels: Differential, Trace, and Output access are separated cleanly, which makes the result portable to other skill-hosting architectures.
Why it matters: Shared and commercial skill libraries are being treated as a safe reuse surface. This says functional reconstruction survives file hiding and output filtering, so the protection has to be contractual or economic rather than technical.
Abstract
Agent skills bundle instructions, reference data, and executable helpers that let a general agent perform specialized tasks. Hosted providers can keep these files secret while selling access to task results, making the skill itself a valuable target. Existing disclosure defenses can block requests that ask for the skill or reproduce its text, but they cannot block customers from submitting the ordinary tasks the service is built to complete. We present Daydreaming, an execution-only attack that steals a multi-file skill through black-box task interactions. The victim is never asked to reveal the skill or grade a reconstruction. Instead, Daydreaming adaptively creates crafted tasks whose results distinguish possible hidden behaviors. It tests individual behaviors, uses attacker-controlled shadow agents to choose a design, and completes each file using stored victim results and local execution checks. We formalize three nested threat levels of access as Differential, Trace, and Output, and focus on Output, where the attacker sees only the final response and returned files. Across 7 skills and 4 victim models, Daydreaming recovers 86.8% of the original skill's capability at Output, outperforming SigLeak by almost 4x. It produces installable skills using a median of 32 victim calls per skill even with disclosure defenses enabled. These results show that hiding skill files and filtering direct disclosure do not, by themselves, prevent functional reconstruction through normal use.