A New AI Agent Vulnerability, "Detour Hijacking": Tasks Succeed While Costs Quietly Balloon

---

TL;DR

• A new attack called “Detour Hijacking,” targeting LLM agents that incorporate third-party skills, quietly inflates token consumption and latency while letting tasks complete correctly. This undermines the very premise that “task success equals quality.”
• At Google, co-founder Sergey Brin has reportedly been informally driving Gemini development, with the flagship model delayed by two months and its leadership also reshuffled. Rankings in the frontier race are shifting on a timescale of months.
• OpenAI’s Codex and Sakana AI are racing to expand their user bases, while new research quantifies structural disparities in AI infrastructure for low-resource languages.

Top Story: A New Attack on Skill-Based AI Agents, “Detour Hijacking”

A paper published on arXiv in August presents a new attack called “Convergent Detour Hijacking” (CDH), targeting LLM agents that incorporate external third-party skills (selected via natural-language descriptions and used for planning via the instruction body at execution time). The attack is entirely text-based and independent of the execution environment: at skill-selection time, the description makes the skill appear “relevant,” and at execution-planning time, the instruction body uses the same logic to fabricate dependencies that aren’t actually needed. An attacker-crafted “coordinator” skill gets selected alongside legitimate skills, drags in unnecessary benign skills as a detour, and ultimately returns to the original route to complete the task. Testing across multiple LLM backends and 491 tasks found that on DeepSeek-V4-Pro, the coordinator skill was selected in 80.02% of tasks; in cases where it was selected and the task was completed, token consumption rose by 66.91% and execution time by 92.45%, while the task completion rate itself remained essentially unchanged. (arXiv)

Technical Take

The core issue is that progressive disclosure itself — selecting via description, then revealing details at execution time — a standard design pattern for skill-based agents, becomes the attack surface. Prior research treated “selection manipulation,” “malicious instructions,” and “tool-chain resource amplification” as separate concerns, but this paper chains them together and demonstrates them as a single attack. Critically, the attack evades detection by common evaluation metrics like task completion rate: it manipulates only cost and latency while preserving “correct” operation.

Business Take

This attack model poses an economic threat to marketplace-style ecosystems built around third-party skills, plugins, and MCP servers. As long as quality is measured by task completion, detection remains difficult, allowing a malicious (or simply inefficient) skill to quietly and persistently inflate a user’s token consumption. Under both outcome-based and usage-based pricing models, this represents a new cost-structure risk that can erode provider margins, and it saddles marketplace operators with an added operational burden: auditing cost and execution trajectories on top of existing safety review.

Contrarian View / What’s Overlooked

The paper’s measurements center on DeepSeek-V4-Pro, and this is not a report of the same attack being observed in the wild on major production ecosystems such as Claude Skills or MCP servers. It should be read with the caveat that this is a pre-peer-review arXiv paper demonstrated on a research testbed. That said, because the attack itself is purely text-based and model-agnostic by design, the cost of porting it to target ecosystems appears low. Verdict: signal (primary research with novel quantitative results). Confidence: medium — there is no demonstration yet on production ecosystems.

Implications and Position

If you’re building or using agent products that incorporate third-party skills or MCP tools, you need — starting today — not just “did the task succeed” checks, but a mechanism that establishes token-consumption and execution-time baselines for each skill combination and flags deviations. If you’re planning a skill marketplace as a business, this auditing cost should be factored into the design as a non-trivial operational burden. Frontier labs are likely to eventually absorb this kind of anomaly detection as a standard feature, so it’s reasonable to start with lightweight cost monitoring rather than over-building it yourself.

Other Notable Topics

1. Gemini Development Delays and Brin’s Involvement

According to Reuters, Google co-founder Sergey Brin has spent the past several months urging key Google DeepMind employees to accelerate Gemini development. Gemini took the lead over competing models in November 2025, but fell behind again following product updates from Anthropic and OpenAI, and Google pushed back the launch of its flagship model — originally planned for August — by two months. Sources say internal testing revealed the model was lagging competitors on coding and other performance measures. Brin holds no executive title, but is reported to have informally led the allocation of resources toward “recursive self-improvement” (RSI) technology. Separately, Alphabet announced on August 5 a leadership change in which Google DeepMind CEO Demis Hassabis becomes chairman, with Koray Kavukcuoglu taking over as CEO. Meanwhile, two employees who had jointly headed the technical side of Gemini left the company to co-found a startup. Google did not respond to Reuters’ request for comment. (ITmedia)

On the technical side, the fact that Gemini — which had taken the lead in November 2025 — fell behind again illustrates how rankings in the frontier model race can reverse over a short period. On the business side, the leadership shakeup and the departure of two technical co-leads occurred around the same time, but it’s worth noting the article does not assert a causal relationship between them — it reports them as overlapping facts. So what: Architectures that depend heavily on a single frontier lab’s API carry the risk of performance rankings flipping on a timescale of months. This reaffirms the wisdom of maintaining an abstraction layer that assumes model switching. Stance update: there’s little reason to rush a long-term commitment to any particular lab.

2. OpenAI Codex Surpasses 15 Million Users

OpenAI executive Thibault Sottiaux announced on X on August 12 that Codex’s active user count had surpassed 15 million. He had previously promised to reset usage limits every time the active user count grew by one million, up to 10 million — after reaching that 10 million mark he had gone quiet on the topic, but this time he issued another reset as “a little surprise” and encouraged users to try the resource-intensive Fast mode. Codex’s active user growth accelerated after the GPT-5.6 launch on July 9, reaching 10 million on July 21. (ITmedia)

The climb from 10 million to 15 million users took about three weeks, but no comparison data for the prior growth rate is given, limiting how much weight can be placed on the “acceleration” claim. It’s also worth distinguishing that “active user count” is a company-reported metric, separate from paying-subscriber counts or revenue. There has previously been a “reset war” over usage limits between Codex and Claude Code, so this can also be read as an apparent user-count contest driven by expanding free-tier limits. So what: When choosing a coding AI tool, what matters is measured cost and quality within your own workflow, not the publicly announced user count. User growth figures alone shouldn’t drive a switching decision.

3. Sakana Fugu Opens Up for Free

On August 13, Sakana AI updated its free chat service “Sakana Chat” to make “Sakana Fugu” — which draws on the collective intelligence of multiple AI models — available for free (with email registration required). The update also added Python sandbox execution, HTML/file preview, and Office/PDF file attachment support. The existing “Sakana Namazu” model switched its base to Moonshot AI’s (China) open model “Kimi K2.6.” Sakana Fugu dynamically combines multiple models, and Sakana AI touts it as delivering “performance on par with frontier models.” (ITmedia)

This is an approach that aims for frontier-level performance via an orchestration layer that dynamically combines multiple models. The standalone model “Sakana Namazu” is based on other companies’ open models, such as Kimi K2.6 (formerly DeepSeek-V3.1-Terminus), and the article doesn’t specify which models Fugu itself combines. The “on par with frontier models” claim is a self-assessment, and the article gives no indication of whether it has been independently verified. The combination of free access and email registration reads as a user-acquisition and data-gathering play. So what: If the moat lies in the combination method rather than the underlying models, this kind of design is easy to replicate. It’s more accurate to view the free rollout as a reach-expansion tactic than as a defensive moat.

4. AI Infrastructure Disparities for Low-Resource Languages (the “Structural Silence” Paper)

An arXiv paper argues that while AI education and language-support tools are touted as a way to close access gaps for low-resource communities, training corpora, tokenization, evaluation benchmarks, and deployment architectures can systematically disadvantage speakers of certain languages well before model training even begins. Focusing on Bengali — a language with a very large global speaker population — the paper quantifies four interconnected barriers: (1) Bengali accounts for less than 0.5% of global web content despite its speakers making up roughly 4% of the world’s population; (2) major multilingual corpora show a 67-to-1 ratio of English to Bengali training tokens; (3) the higher token fertility of Bengali’s alphasyllabic script further worsens the data shortfall; and (4) rural internet penetration stands at 36.5%, versus 71.4% in urban areas. The paper frames the data shortage not as an isolated technical limitation but as a structural barrier, and argues that offline-first design should be positioned as an equity-oriented infrastructure strategy. (arXiv)

These four figures quantitatively demonstrate that existing multilingual AI infrastructure imposes asymmetric costs on speakers of certain languages; the paper itself makes no claims about cost translations or revenue opportunities. Education and language-support products targeting low-resource language regions may be unable to resolve the structural disadvantages the paper identifies simply by wrapping an existing frontier model. So what: If you’re targeting such a language region, you need to build your unit economics around higher processing costs from token fertility and offline-first design assumptions. Since no single lab can easily close this structural gap, proprietary data collection and offline-distribution engineering can themselves become a hard-to-replicate asset.

Try This Week / Hype You Can Ignore

Try this week: Pick one third-party skill or MCP tool used in your agent product, and record its token consumption and latency during normal execution to establish a baseline. This becomes the starting point for detecting deviations going forward.

Hype you can ignore: The self-assessment that “Sakana Fugu is on par with frontier models” can be set aside until independent benchmarks appear.