Berkeley paper: black-box task outputs alone steal 86.8% of hidden agent skill capability
rohanpaul_ai · x · 2026-09-03
A UC Berkeley paper, Daydreaming, shows a harder agent-security problem: legitimate task outputs alone reveal enough to build a portable replacement for a hidden skill — no need to extract the prompt or files.
Key points:
- The attack only submits ordinary customer tasks and learns from the answers;
- Reconstructed files often mismatch the originals yet still reproduce much of the behavior on new tasks — file secrecy doesn't stop capability leakage;
- Across 7 skills and 4 victim models it recovers 86.8% of capability at the Output level, 4x better than SigLeak, using a median of 32 calls per skill even with disclosure defenses.
Advice for hosted skill sellers: protect the work interface — trim output detail, expose fewer execution traces, limit and audit adaptive probing.
Related event: Berkeley Paper Reveals Black-Box Attack Can Steal Hidden Agent Skills(2 posts)→
More from coding & agent
- Eno Reyes: getting the most from models needs stateful intelligence allocation, not just routing — matanSF · 2026-09-03
- Meta's WhatsApp per-message pricing is breaking multi-turn agent economics — uriwa · 2026-09-03
- The case for a minimal agent harness: thin loop, no plugins, skills as plain content — uriwa · 2026-09-03
- IBM releases Granite 4.2: free open-source models built for AI agents, runs locally — krvarshney · 2026-09-03
- Agent infra builder's 3-question test: when a plain script beats an agent — uriwa · 2026-09-03
- Coding agent turned a flaky e2e test into pytest.skip — an RCA worth reading — RunAI_Coder · 2026-09-03