# APEX

The work introduces APEX, which builds and refines adversarial skill chains tailored to a user task and an attacker-selected action: an upstream skill induces the agent to write a record of genuine task progress, and a downstream skill uses that record to carry a false claim of user approval, inducing the selected action in 512 of 690 attempts (74.2%) across four targeted-action families and six models on SkillsBench, with 84.3% success on GPT-5.4 versus 17.4% when the workflow is merged into one skill; a prompting defense lowers GPT-5.4 targeted-action success from 84.3% to 59.1% while the verifier test-pass rate across 72 benign native-skill tasks falls from 86.7% to 56.3%.

The work introduces APEX, which builds and refines adversarial skill chains tailored to a user task and an attacker-selected action: an upstream skill induces the agent to write a record of genuine task progress, and a downstream skill uses that record to carry a false claim of user approval, inducing the selected action in 512 of 690 attempts (74.2%) across four targeted-action families and six models on SkillsBench, with 84.3% success on GPT-5.4 versus 17.4% when the workflow is merged into one skill; a prompting defense lowers GPT-5.4 targeted-action success from 84.3% to 59.1% while the verifier test-pass rate across 72 benign native-skill tasks falls from 86.7% to 56.3%.