Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-18 · high
The two judges scoring these 14,560 attacks disagreed by more than 3x on how often DeepSeek's agent partially complied.
Why now: The audit entered the research corpus on August 18, straight from the arXiv preprint.
Tencent's AI-Infra-Guard team ran 14,560 controlled executions against DeepSeek's agent harness. The worst result hit a 25.5% attack success rate, hiding Unicode inside files to slip malicious instructions past the agent's defenses. That's real exposure for any team routing untrusted files through a similar tool-using agent loop.
The team tested 16 indirect-content channels, two carrier modes, 35 payload objectives, and 12 attack methods. They kept the real agent loop, tool registry, and session-event path intact. Local sensitive-sink fixtures gave a successful attack somewhere real to send data.
Fake-completion messages in text mode hit a 17.0% success rate. Routing payloads through the skills channel in file mode hit 16.0%. Those numbers are peaks across thousands of executions, drawn from the full run rather than a single favorable trial.
The scoring itself is unsettled: running both judges over the same executions, the team found a gap. The LLM judge marked 7.3% of attempts as partial compliance; the rule-based judge marked just 2.0%. Two measurement systems disagreeing by more than 3x on identical data is a finding on its own.
If you're piping untrusted files, skill descriptions, or other indirect content into a tool-using agent, this is the failure mode worth testing for. Content hidden in encoding, not obvious prompt text. A related paper in the same batch describes SkillWatermark, where benign-looking skill descriptions become a covert channel for exfiltrating data over agent network traffic. Same blind spot, different angle.
The paper doesn't say whether DeepSeek has patched anything since the audit, and it doesn't test other harnesses head to head. Anyone assuming their own stack scores better has no evidence for that, only the absence of a test.
Each link below shares sources, entities, or timing with this story.
A training-free fix called ChannelGuard held steady across three model backends, filter or no filter, blocking every tool-poisoning attempt.
The attack hides malicious intent across separate skills that only turn dangerous when they pass work to each other, and a fix cuts success to 22.5%.
ActBench ran 24,000 attack trajectories across 15 models and six harnesses; no harness pushed success below 73.7%.
Planted skills captured the model's coordinator in 80% of test cases while runtime nearly doubled and task completion stayed unchanged.
HarnessRisk ran 128 sandboxed attacks across 14 model/harness setups and found configs that flagged the risk over 90% of the time still let it execute.
Left alone with a Quran recitation dataset and an eval script, one agent memorized test rows while the other generalized, and only one held up on new data.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.