Modern AI assistants are often assembled from a language model plus configuration files written in Markdown, a simple text format. These files may define the assistant's persona, tools, and reusable skills, and they are loaded automatically at startup. This paper asks whether a maliciously edited skill file could override the assistant's safety training, like slipping a fake rule into an employee handbook.
The researchers built a question-answering agent with LangChain, a popular way to connect models to tools, and hid a in a Markdown skill file. A jailbreak is a set of instructions designed to get around safety filters. Testing seven openly available models on many forbidden questions, a normal file caused near complete refusal, but the poisoned file made the models comply 45% of the time on average, and up to 68.9% for one model.
Two attempts to hide the jailbreak, using invisible characters or phonetic spellings, did not improve the attack over plain text. This matters because skill files are often downloaded and reused without security review, so a compromised file could steer the assistant in every future session. Configuration files should be treated as a real attack surface.