--- title: UC Berkeley paper shows hiding agent skill files doesn't... description: A UC Berkeley paper called Daydreaming demonstrates that hidden agent skill files (like SKILL.md or internal prompts) can be reverse-engineered purely from... canonical: https://daily.dev/posts/uc-berkeley-paper-shows-hiding-agent-skill-files-doesn-t-actually-protect-them-zjr7dmn4v twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: UC Berkeley paper shows hiding agent skill files doesn't actually protect them | daily.dev og:description: A UC Berkeley paper called Daydreaming demonstrates that hidden agent skill files (like SKILL.md or internal prompts) can be reverse-engineered purely from... og:url: https://daily.dev/posts/uc-berkeley-paper-shows-hiding-agent-skill-files-doesn-t-actually-protect-them-zjr7dmn4v og:image: https://api.daily.dev/og/posts/zjR7dMN4v.png og:image:alt: UC Berkeley paper shows hiding agent skill files doesn't actually protect them og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # UC Berkeley paper shows hiding agent skill files doesn't actually protect them **[Collections](https://daily.dev/sources/collections)** · 1 min read · 2 upvotes · 0 comments ## Summary A UC Berkeley paper called Daydreaming demonstrates that hidden agent skill files (like SKILL.md or internal prompts) can be reverse-engineered purely from observing normal task outputs, without ever accessing the underlying files. By sending ordinary customer-style tasks to a hosted agent and learning from its responses, researchers reconstructed an agent that reproduced 86.8% of the original's behavior on new tasks - even when the recovered files looked quite different from the originals at the file level. This shows file-level secrecy and behavioral secrecy are distinct problems, and protecting the prompt file alone doesn't stop capability leakage. The paper recommends reducing output detail, limiting exposed execution traces, and auditing adaptive probing to protect hosted agent skills. ## Content A new paper from UC Berkeley called Daydreaming points to a security problem that's harder to fix than it might look: you don't need access to an agent's hidden prompt or skill files to copy what it does. Normal task outputs are enough. The attack works by feeding the agent ordinary customer tasks and learning from the responses. No jailbreaking, no prompt extraction, no file access. Just observing the agent do its job. From that alone, the researchers recovered 86.8% of the agent's behavior. Here's the part that makes this genuinely tricky: the reconstructed skill files often matched the originals poorly at the file level. A forensic comparison would show they're different. But they still reproduced most of the behavior on new tasks. So a skill can stay secret in the literal sense - nobody has your SKILL.md - while its actual capability leaks through normal use. If you're selling hosted agent skills, the paper's practical recommendations are to reduce unnecessary output detail, expose fewer execution traces, and limit or audit adaptive probing. The work interface itself needs protection, not just the files behind it. ## Questions this post answers ### Can hidden AI agent skill files or system prompts be stolen without jailbreaking or direct file access? Yes, a UC Berkeley paper called Daydreaming shows that feeding an agent ordinary customer tasks and observing its responses is enough to reconstruct 86.8% of its behavior, with no jailbreaking, prompt extraction, or file access required. The reconstructed skill files often differ substantially from the originals at the file level, yet still reproduce most of the original capability on new tasks. _Teams shipping hosted agent skills can follow daily.dev to track emerging defenses against this kind of behavior leakage._ ### How can I protect hosted agent skills from being copied through normal usage? Reduce unnecessary output detail, expose fewer execution traces, and limit or audit adaptive probing of the agent's interface, since the Daydreaming research found that secrecy of the underlying skill file alone does not prevent its behavior from being reconstructed through observation of ordinary responses. _daily.dev surfaces practical mitigation research for anyone hardening agent interfaces against behavior extraction._ ## Similar posts on daily.dev - [Auditing Agent Skills: A Threat Model for the Next Generation of AI Package Managers](https://daily.dev/posts/auditing-agent-skills-a-threat-model-for-the-next-generation-of-ai-package-managers-vxdluywso) · DEV · 10 upvotes · 0 comments - [Agent Skills: Explore security threats and controls](https://daily.dev/posts/agent-skills-explore-security-threats-and-controls-judzhn2fh) · Red Hat Developer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/uc-berkeley-paper-shows-hiding-agent-skill-files-doesn-t-actually-protect-them-zjr7dmn4v) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"UC Berkeley paper shows hiding agent skill files doesn't actually protect them","url":"https://daily.dev/posts/uc-berkeley-paper-shows-hiding-agent-skill-files-doesn-t-actually-protect-them-zjr7dmn4v","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/uc-berkeley-paper-shows-hiding-agent-skill-files-doesn-t-actually-protect-them-zjr7dmn4v"},"datePublished":"2026-09-03T02:35:27.925Z","dateModified":"2026-09-13T19:55:25.338Z","description":"A UC Berkeley paper called Daydreaming demonstrates that hidden agent skill files (like SKILL.md or internal prompts) can be reverse-engineered purely from...","image":"https://pbs.twimg.com/media/HRQi4LubUAAmYUF.png","thumbnailUrl":"https://pbs.twimg.com/media/HRQi4LubUAAmYUF.png","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/uc-berkeley-paper-shows-hiding-agent-skill-files-doesn-t-actually-protect-them-zjr7dmn4v","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,prompt-injection","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"UC Berkeley paper shows hiding agent skill files doesn't actually protect them"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/uc-berkeley-paper-shows-hiding-agent-skill-files-doesn-t-actually-protect-them-zjr7dmn4v#faq","mainEntity":[{"@type":"Question","name":"Can hidden AI agent skill files or system prompts be stolen without jailbreaking or direct file access?","acceptedAnswer":{"@type":"Answer","text":"Yes, a UC Berkeley paper called Daydreaming shows that feeding an agent ordinary customer tasks and observing its responses is enough to reconstruct 86.8% of its behavior, with no jailbreaking, prompt extraction, or file access required. The reconstructed skill files often differ substantially from the originals at the file level, yet still reproduce most of the original capability on new tasks. Teams shipping hosted agent skills can follow daily.dev to track emerging defenses against this kind of behavior leakage."}},{"@type":"Question","name":"How can I protect hosted agent skills from being copied through normal usage?","acceptedAnswer":{"@type":"Answer","text":"Reduce unnecessary output detail, expose fewer execution traces, and limit or audit adaptive probing of the agent's interface, since the Daydreaming research found that secrecy of the underlying skill file alone does not prevent its behavior from being reconstructed through observation of ordinary responses. daily.dev surfaces practical mitigation research for anyone hardening agent interfaces against behavior extraction."}}]} ```