Before you prompt AI to answer another question or perform another task, a Wake Forest computer scientist wants you to know it could expose your sensitive data.
Ying Zhang, an assistant professor in Wake Forest University's Department of Computer Science, studies security in software engineering. Her latest research, "How Your Credentials Are Leaked by LLM Agent Skills," explores how large language model (LLM) agents make data vulnerable to attacks.
- LLM agents are autonomous AI systems that analyze circumstances to plan and execute multistep actions to achieve a goal.
- A skill is a reusable software extension that gives an LLM agent new capabilities. By installing skills into LLM agents—like Claude Code, Codex or Cursor—developers can teach agents to perform specialized tasks, such as accessing a database or analyzing domain-specific information.
- The credentials in danger of exposure include secret identifiers intended to allow two systems to communicate safely without granting access to sensitive data.
The exposure happens through the use of third-party AI agent skills. The tasks the skills perform could include anything from creating a presentation using your notes to scanning financial documents for compliance issues.
To read more, click here.