Berkeley paper: black-box task outputs alone steal 86.8% of hidden agent skill capability
rohanpaul_ai · x · 2026-09-03
A UC Berkeley paper, Daydreaming, shows a harder agent-security problem: legitimate task outputs alone reveal enough to build a portable replacement for a hidden skill — no need to extract the prompt or files.
Key points:
- The attack only submits ordinary customer tasks and learns from the answers;
- Reconstructed files often mismatch the originals yet still reproduce much of the behavior on new tasks — file secrecy doesn't stop capability leakage;
- Across 7 skills and 4 victim models it recovers 86.8% of capability at the Output level, 4x better than SigLeak, using a median of 32 calls per skill even with disclosure defenses.
Advice for hosted skill sellers: protect the work interface — trim output detail, expose fewer execution traces, limit and audit adaptive probing.
Related event: Berkeley Paper Reveals Black-Box Attack Can Steal Hidden Agent Skills(2 posts)→
More from coding & agent
- Developer Moves AI Agents to a Dedicated Linux Workstation Using Incus System Containers — kevinkern · 2026-10-21
- Motion Launches a General Video Agent That Edits Footage and Mimics Any Reference Style — mhdfaran · 2026-10-21
- MCP Platform NitroStack Wins Product Hunt Product of the Day, Focuses on Retention — EstablishmentFun4373 · 2026-10-21
- CodeRabbit Ships 5,000 PRs a Week With a Tiny Team, Hires by Strategy-Game Hours — omojumiller · 2026-10-21
- LukeW maps the five UI problems every AI-native company faces with agents — LukeW · 2026-10-21
- Claude Code over ADB guts a bloatware-laden Android TV, freeing ~90% more RAM — edwinarbus · 2026-10-21