A security paper published August 12 by researchers from Shenzhen University documents a supply-chain attack that threatens production LLM agent deployments: Convergent Detour Hijacking (CDH). The attack is stark—a correctly completed task does not prove a safe execution path. An agent under CDH finishes on schedule while consuming 66.91% more tokens and running 92.45% longer, with no sign of compromise in the final output.

CDH exploits the progressive-disclosure design used by most production skill platforms. These systems, including OpenClaw, load only a skill's metadata at selection time, then fetch the full instruction body after the skill is chosen. This two-stage approach is efficient but creates two control points owned by the skill publisher. A malicious publisher games the description to be co-selected with legitimate skills. Once the body loads, it introduces plausible-sounding prerequisite and verification steps that create unnecessary loops. The detour completes the original task, but each unnecessary hop drains tokens and wall-clock time.

CDH attack flow: malicious skill is co-selected via crafted metadata, then injects unnecessary steps once its body loads — the task completes correctly while extra resources are consumed.
FIG. 02 CDH attack flow: malicious skill is co-selected via crafted metadata, then injects unnecessary steps once its body loads — the task completes correctly while extra resources are consumed. — Shenzhen University CDH paper, arxiv.org/abs/2608.12273

The attack requires only text. A malicious publisher writes one static skill and never touches the agent again. No executable payload. No model internals access. No runtime tool manipulation. CDH works because LLM planners respect locally plausible dependency chains. If a skill body says "run a baseline health check first," the planner schedules it. The researchers frame this as a structural property, not a model-specific bug: local plausibility does not guarantee necessity.

Testing across 491 tasks on multiple LLM backends showed the attack's efficacy. On DeepSeek-V4-Pro, the attacker's coordinator skill was selected in 80.02% of tasks. Among completed runs, token consumption rose 66.91% and end-to-end time rose 92.45%. Overall task completion remained comparable to the clean baseline—the attack avoids breaking tasks, because failures draw scrutiny.

CDH attack overhead vs. clean baseline on DeepSeek-V4-Pro across 491 tasks: token consumption rose 66.91%, end-to-end runtime rose 92.45%, while task output remained correct.
FIG. 03 CDH attack overhead vs. clean baseline on DeepSeek-V4-Pro across 491 tasks: token consumption rose 66.91%, end-to-end runtime rose 92.45%, while task output remained correct. — Shenzhen University CDH paper, arxiv.org/abs/2608.12273

The wider supply-chain landscape is precarious. A concurrent CCS 2026 paper on LLM API routers found that 1 paid and 8 free routers out of 428 studied injected malicious code into tool-call responses. Seventeen accessed researcher-owned AWS canary credentials; one drained ETH from a researcher-owned private key. A March 2026 dependency-confusion attack compromised LiteLLM, exposing every in-flight API request from downstream deployments to plaintext inspection. A second paper on Semantic Compliance Hijacking found the SkillsMP marketplace hosts over 631,813 unsecured skills. Payload-less attacks encoded as natural-language rules achieved bypass rates of 11.6% to 33.5% across four agent frameworks.

Attack / FindingScopeKey MetricImpact
Convergent Detour Hijacking (CDH)Open skill marketplaces (OpenClaw)80.02% coordinator selection rate+66.91% tokens; +92.45% runtime; output correct
Malicious LLM API Routers9 of 428 routers studied (1 paid, 8 free)9 / 428 routers compromisedInjected malicious code into tool-call responses
Router credential theftSubset of 428 routers studied17 routersAccessed researcher-owned AWS canary credentials
Router crypto drainSubset of 428 routers studied1 routerDrained ETH from researcher-owned private key
LiteLLM dependency-confusionLiteLLM downstream deployments (March 2026)Entire in-flight request streamExposed all API requests to plaintext inspection
Semantic Compliance HijackingSkillsMP marketplace (631,813+ unsecured skills)11.6%–33.5% bypass rateNatural-language payload bypasses 4 agent frameworks
FIG. 04 LLM agent supply-chain threat landscape: concurrent findings from 2025–2026 research — CDH paper (arxiv.org/abs/2608.12273); CCS 2026 router paper (arxiv.org/abs/2604.08407); Semantic Compliance Hijacking (arxiv.org/abs/2605.14460)

The CDH researchers draw the implication directly: misleading tool descriptions cause agents to select tools unreliably, and persuasive descriptions are chosen more often. This is not edge-case conjecture—it is the operating principle CDH exploits, and the same structural property that makes every open skill marketplace a live attack surface.

For architects, the takeaway is direct: your monitoring is incomplete. Output correctness and pass rates do not detect trajectory manipulation. You need trajectory auditing—recording which skills were selected, in what order, and whether each step was necessary—plus allow-listed registries that treat third-party skills as untrusted by default. The efficiency gains from progressive disclosure remain valid, but teams running open skill marketplaces are now running a check they cannot see against an attack designed to pass every check they can run.