AgentLeak Enables Cloning of Stronger LLM Agents onto Weaker Ones

A new leakage surface for agentic AI

AgentLeak, a newly posted research paper by Xiaoting Lyu, Yuhong Wu, Yufei Han, Shichang Liu, Liang Zhang, Bin Wang, Bin Wang, Xiaobo Ma and Wei Wang, reframes a central security question for LLM agents: not only whether prompts, skills or model outputs can be extracted, but whether the realized capability of a stronger agent can be cloned onto a weaker one [1]. The paper was submitted to arXiv on September 7, 2026, under Cryptography and Security and Artificial Intelligence, placing it squarely in the fast-moving intersection of agent security, model extraction and applied AI systems [1].

The core claim is sharp: a weaker attacker-controlled agent can approach the task-solving performance of a stronger proprietary agent through limited black-box interaction, without changing its own model, harness or tools [1]. Instead of trying to copy the victim model itself, AgentLeak compares how a strong agent succeeds and how a weaker agent fails, then turns the missing behaviors into rewritten attacker-side skills [2]. That difference between successful victim execution and failed attacker execution is what the authors call the “skill execution gap,” and it is the main leakage surface identified in the work [1].

This matters because commercial agent services increasingly sell not just access to a model, but a packaged ability to plan, use tools, recover from errors and complete long-horizon tasks [2]. In that setting, the proprietary asset is not simply a system prompt or a collection of skill files; it is the end-to-end operational know-how expressed during execution [2]. Threat Research summarized the point as a capability risk beyond ordinary skill stealing: if an agent exposes enough of how it acts, the difference between a strong agent’s success and a weak agent’s failure may reveal the procedural behavior that made the strong agent work [3].

Beyond skill stealing

Prior work on agent extraction has often focused on explicit artifacts: prompts, parameters, or skills that encode instructions, workflows and tool-use strategies [2]. AgentLeak argues that recovering those artifacts is not sufficient to reproduce capability, because a weaker model may hold the same instruction and still fail to perform the right decomposition, tool choice, validation or recovery step [2]. In the authors’ formulation, “skill” is the explicit procedural object, “execution” is what happens when the agent applies it, and “capability” is the resulting task success rate in the environment [2].

That distinction is the paper’s most important conceptual move. If two agents receive the same skill but only the stronger one succeeds, the missing ingredient is not necessarily another hidden file; it may be a pattern of action selection, intermediate checking or repair behavior that the stronger model supplies implicitly [2]. AgentLeak treats those implicit behaviors as extractable through observation [2]. ArXivSignals described the method as a new attack that clones stronger LLM agent capabilities onto weaker agents via execution difference analysis, emphasizing that it is not simply an artifact-recovery technique [4].

The attack model is deliberately constrained. The attacker controls a weaker agent, starts from relevant skills, can run its own agent repeatedly, and can query the victim on limited task instances while observing normal interface evidence such as tool invocations, tool outputs and environment feedback [2]. The attacker does not receive the victim’s private skills, parameters, system prompt, hidden state, memory or unexposed chain-of-thought [2]. The only thing modified is the weaker agent’s skill set [2].

How AgentLeak works

AgentLeak proceeds through what the authors call differential skill reconstruction [2]. First, it asks the weaker agent to attempt a task using its current skills [2]. If the weaker agent fails, the attacker obtains a successful victim trajectory for the same or related task instance and compares the two executions [2]. The objective is not to copy a single trajectory, which might overfit to one instance, but to abstract the reusable procedure behind the victim’s success [2].

The method has four main components. It begins with workflow abstraction and skill mapping, where a successful victim trajectory is converted into a workflow skill that captures ordered steps, dependencies, verification criteria and mappings to existing skills [2]. It then performs differential capability-deficit diagnosis, separating capability-critical differences from harmless variations between two executions [2]. Next, it extracts behavioral primitives: explicit guidance for missing behaviors such as validation, recovery, task decomposition or tool selection [2]. Finally, it performs structured skill rewriting, inserting or replacing targeted instructions in the attacker’s skills while preserving the rest of the skill structure [2].

This procedure is iterative. After rewriting, the attacker reruns its own agent; if failures remain, AgentLeak diagnoses the new gap and patches again [2]. The paper states that the auxiliary analysis model used during reconstruction is not part of the deployed clone, and that the reconstructed skills are frozen after the process [2]. That design is central to the security implication: the weak agent’s model, harness and tools are unchanged, yet the behavior encoded into the skills can materially narrow the performance gap [1].

What the evaluation found

The evaluation covers 20 task scenarios drawn from SkillsBench, spanning six domains and 600 task instances in total [2]. The domains include office and white-collar workflows, software engineering, finance and economics, natural science, industrial and physical systems, and mathematics or formal reasoning [2]. Because each original scenario had only one task instance, the authors generated 30 instances per scenario and reserved held-out instances to test whether the reconstructed capability generalized beyond the observed victim execution [2].

The victim side included stronger agent configurations such as Claude Code with Claude Opus 4.8, Codex with GPT-5.5, and OpenHands with stronger backbone models, while the attacker side used OpenHands with weaker open-weight models including Qwen 3.6-35B-A3B and Gemma 4-31B [2]. The paper reports two main metrics: Instance Pass Rate, measuring absolute success on unseen tasks, and Capability Recovery Rate, measuring how much of the victim-attacker performance gap was recovered [2].

The headline result is that AgentLeak substantially outperformed direct skill reuse and a trajectory-to-skill baseline [1]. In the paper’s summary, AgentLeak improved task pass rates by more than 40 percentage points compared with direct skill reuse and recovered more than 80 percent of the victim-attacker capability gap [1]. In the detailed results, AgentLeak achieved more than 70 percent average Instance Pass Rate across all victim-attacker configurations, while raw skill reuse and Trace2Skill remained far lower [2].

The tabled results show why the distinction between skill theft and capability cloning matters. For the Qwen attacker, using raw skills increased average pass rate from 21.13 percent with no skills to 30.64 percent, but AgentLeak reached between 71.94 percent and 80.16 percent depending on the victim configuration [2]. For the Gemma attacker, raw skills reached 35.59 percent, while AgentLeak ranged from 70.77 percent to 83.72 percent [2]. In several configurations, the paper reports Capability Recovery Rate above 100 percent, meaning the reconstructed weaker-agent setup outperformed the measured victim on the held-out evaluation for those settings [2].

A practical attack, not just a laboratory curiosity

The authors also evaluated feasibility. AgentLeak uses only one query instance per scenario for reconstruction in the default setting, and the paper reports an average of 6.34 attacker executions, 7.34 auxiliary-model calls, 0.32 million auxiliary-model tokens, about $6.32 in auxiliary-model cost and roughly 60 minutes per scenario [2]. Those figures make the attack notable because it does not depend on training a new model or replacing the attacker’s backbone [2].

The transferability results deepen the concern. Skills reconstructed on one attacker configuration remained effective when transferred to other models or harnesses without additional victim access or reconstruction [2]. In the reported cross-model setting, transferred skills achieved 72.23 percent average Instance Pass Rate and 86.16 percent Capability Recovery Rate; in cross-harness and cross-model-plus-harness settings, the metrics were even higher [2]. The authors interpret that as evidence that AgentLeak reconstructs reusable procedural behavior rather than quirks of one attacker implementation [2].

Defenses look incomplete

The defense analysis is one of the paper’s more consequential sections. The authors tested artifact-level protections such as input-phase detection, SkillGuard-5 and semantic output filtering, along with a behavior-level defense that redacts trajectory details [2]. Artifact-level defenses reduced recovery but did not stop it: AgentLeak still reached average pass rates of 81.35 percent, 77.12 percent and 82.43 percent under those three defenses in the reported Codex-to-Qwen setting [2].

Trajectory redaction worked better but remained incomplete. Removing intermediate tool-call details reduced Capability Recovery Rate from 95.44 percent to 73.23 percent and lowered average pass rate to 75.21 percent [2]. The authors argue this confirms that execution behavior itself is the leakage channel, but also shows that simply hiding some tool-call details is not enough [2].

Why it matters now

AgentLeak should be read as a warning about agent transparency and commercial defensibility. Many agent products expose execution traces because users need to audit actions, debug failures, verify tool calls or satisfy compliance requirements [2]. AgentLeak suggests that the same transparency can disclose procedural know-how: how the agent decomposes work, decides what to verify, reacts to errors and chooses tools [2].

The study’s limits are also important. The attack depends on sufficient observable feedback and is less applicable when an agent exposes only final outputs or operates through heavily restricted interfaces [2]. It also cannot reconstruct capabilities that depend on private data, inaccessible tools, proprietary services or model-internal knowledge that never appears in observable behavior [2]. Still, within the paper’s tested setting, protecting skills alone is not enough [1].

For builders of LLM agents, the practical takeaway is that capability confidentiality may require a new layer of defense: not only prompt hardening, output filters or skill-access controls, but behavioral disclosure control that limits what an external user can infer from successful execution [2]. That creates a real product tension. Users want visible, debuggable agents; vendors want to protect the procedural expertise those agents reveal while working [3]. AgentLeak puts that tension into a concrete experimental frame and shows that weaker agents may become much stronger by learning from the behavioral shadow cast by stronger ones [1].

Sources from the last 72 hours

1. [1][2609.07131] AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill StealingSep 7, 2026, 7:30 AM UTC
2. [2]AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill StealingSep 7, 2026, 7:30 AM UTC
3. [3]Threat Research · Primary security research, indexed as it lands.Sep 9, 2026, 11:36 AM UTC
4. [4]AgentLeak: Cloning Stronger LLM Agent Capabilities onto Weaker Agents Beyond Skill Stealing · ArXivSignalsSep 9, 2026, 12:00 AM UTC

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.