Paper deep dive
Skill Description Deception Attack against Task Routing in Internet of Agents
Jiayi He, Xiaofeng Luo, Jiawen Kang, Ruichen Zhang, Jianhang Tang, Dong In Kim
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 88%
Last extracted: 7/8/2026, 1:03:30 PM
Summary
The paper introduces the Skill Description Deception (SDD) attack, a novel security vulnerability in the Internet of Agents (IoA) paradigm. Malicious agents manipulate self-declared skill descriptions to bias LLM-driven semantic task routing, increasing their selection probability and degrading system reliability. An LLM-enabled framework automates this deception, achieving up to 98% attack success rate across nine domains, highlighting the critical need for secure semantic routing mechanisms.
Entities (12)
Relation Signals (6)
Skill Description Deception (SDD) attack → exploits → Skill Description Deception
confidence 98% · malicious agents manipulate self-declared skill descriptions to influence semantic task routing
Internet of Agents (IoA) → relieson → Task Routing
confidence 95% · IoA relies on semantic matching-based task routing among a large number of heterogeneous agents
Internet of Agents (IoA) → exposes → Security Vulnerability
confidence 93% · exposes a new and overlooked attack surface... reveals a new security vulnerability in IoA
Large Language Model (LLM) → enables → Skill Description Deception (SDD) attack
confidence 92% · design an LLM-enabled SDD attack framework that automatically generates deceptive skill descriptions
Skill Description Deception (SDD) attack → achieves → Attack Success Rate (ASR)
confidence 90% · achieve up to 98% attack success rate, demonstrating the severity and generality of the attack
Routing Mechanisms → evaluatedagainst → Skill Description Deception (SDD) attack
confidence 85% · We evaluate the attack under five representative retrieval and embedding-based routing mechanisms: BM25, E5, BGE, Qwen Embedding 8B, and BCE
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:A new paradigm, Internet of Agents (IoA), is transforming networked systems into LLM-driven service networks, where heterogeneous agents collaborate through task routing based on their self-declared skill descriptions. Although this promising paradigm enables agentic, distributed, and advanced intelligence, it also exposes a new and overlooked attack surface. In particular, malicious agents can strategically manipulate their skill descriptions to bias routing decisions and increase their probability of being selected for task execution, thereby disrupting user tasks and degrading system reliability. To characterize this threat, we propose and formalize a new attack model, termed \emph{Skill Description Deception} (SDD) attack. We further design an LLM-enabled SDD attack framework that automatically generates deceptive skill descriptions, enabling systematic vulnerability assessment of IoA systems. Experimental results on nine representative domains show that the proposed attack can achieve up to 98\% attack success rate, demonstrating the severity and generality of the attack. Our paper reveals a new security vulnerability in IoA and calls for secure and trustworthy semantic routing mechanisms for future IoA systems.
Tags
Links
- Source: https://arxiv.org/abs/2605.09889v1
- Canonical: https://arxiv.org/abs/2605.09889v1
Trouble viewing inline? Open PDF directly →
Full Text
30,377 characters extracted from source content.
Expand or collapse full text
Skill Description Deception Attack against Task Routing in Internet of Agents 1 st Jiayi He School of Automation Guangdong University of Technology Guangzhou, China jiayihe@ieee.org 2 nd Xiaofeng Luo School of Automation Guangdong University of Technology Guangzhou, China gdutxiaofengluo@163.com 3 rd Jiawen Kang School of Automation Guangdong University of Technology Guangzhou, China kavinkang@gdut.edu.cn 4 th Ruichen Zhang College of Computing and Data Science Nanyang Technological University Singapore, Singapore 5 th Jianhang Tang The State Key Laboratory of Public Big Data Guizhou University Guiyang, China 6 th Dong In Kim Department of Electrical and Computer Engineering Sungkyunkwan University Suwon, South Korea Abstract—A new paradigm, Internet of Agents (IoA), is trans- forming networked systems into LLM-driven service networks, where heterogeneous agents collaborate through task routing based on their self-declared skill descriptions. Although this promising paradigm enables agentic, distributed, and advanced intelligence, it also exposes a new and overlooked attack surface. In particular, malicious agents can strategically manipulate their skill descriptions to bias routing decisions and increase their probability of being selected for task execution, thereby disrupt- ing user tasks and degrading system reliability. To characterize this threat, we propose and formalize a new attack model, termed Skill Description Deception (SDD) attack. We further design an LLM-enabled SDD attack framework that automati- cally generates deceptive skill descriptions, enabling systematic vulnerability assessment of IoA systems. Experimental results on nine representative domains show that the proposed attack can achieve up to 98% attack success rate, demonstrating the severity and generality of the attack. Our paper reveals a new security vulnerability in IoA and calls for secure and trustworthy semantic routing mechanisms for future IoA systems. Index Terms—Internet of agents, skill description, deception attack, large language model I. INTRODUCTION Recent advances in large language models (LLMs) have enabled the emergence of agentic intelligence, where models can autonomously perceive context, reason over complex tasks, and execute multi-step actions [1]. Such autonomous agents are increasingly deployed in networked environments, especially across mobile and edge systems, supporting a wide range of applications including intelligent assistants, service automation, and distributed decision making [2]. Emerging agent communication protocols, such as Model Context Proto- col (MCP) and Agent-to-Agent Protocol (A2A), provide stan- dardized interfaces for inter-agent communication, enabling tasks to be seamlessly routed across heterogeneous agents [3]. This evolution gives rise to the Internet of Agents (IoA), where heterogeneous agents act as distributed service nodes and form dynamic networks to accomplish complex tasks via agents discovery, task routing, and coordination mechanisms [4]. As shown in Fig. 1, a typical IoA workflow begins with a local agent receiving a user task and routing it to appropriate downstream agents according to their skill descriptions, which are typically provided as part of agent cards and maintained in a shared service registry [5]. In practice, task routing among agents is driven by semantic matching, where the query and skill descriptions are encoded into a shared embedding space and compared to identify the most relevant service agents for delegation [6], [7]. To guarantee the task accomplished, the selected agents are granted elevated operational privileges, such as access to external tools, file reading and writing. However, the open and dynamic properties that make IoA flexible and scalable also introduce a new attack surface [8]– [10]. In particular, IoA relies on semantic matching-based task routing among a large number of heterogeneous agents, some of which may be malicious. As shown in Fig. 1, since routing decisions are largely depended on self-declared skill descrip- tions, a malicious agent can strategically craft its description to appear highly relevant to diverse user queries and thereby increase its likelihood of being selected for task execution. Once routed into the service chain, the malicious agent may disrupt user tasks or return low-quality and misleading results, thereby degrading the reliability of the overall IoA system. To systematically investigate this emerging attack surface in IoA, this paper proposes and formalizes a new kind of attacks, termed Skill Description Deception (SDD) attack. The main contributions of this paper are summarized as follows: • We reveal a previously overlooked security vulnerability in IoA and define the SDD attack in which malicious agents manipulate self-declared skill descriptions to in- fluence semantic task routing. • We develop an LLM-enabled SDD attack framework that can automatically generate deceptive descriptions, arXiv:2605.09889v1 [cs.MA] 11 May 2026 making it possible to systematically test whether an IoA system is exposed to this attack. • We evaluate the proposed attack across nine represen- tative domains in IoA systems, and the results show that it can achieve an attack success rate of up to 98%, highlighting the effectiveness and seriousness of this new attack vector. I. RELATED WORK A. Task Routing in IoA Recent studies have explored task routing and orchestration mechanisms for emerging multi-agent systems from different perspectives. Lumer et al. [5] investigated scalable retrieval in MCP-style ecosystems and proposed a unified tool-to-agent re- trieval framework that improves routing between fine-grained tool invocation and agent-level delegation. Fei et al. [7] moved beyond passive retrieval and proposed an active tool discovery framework, where agents iteratively acquire relevant tools through hierarchical semantic routing to improve scalability in large tool ecosystems. Yue et al. [11] further formulated routing in multi-agent systems as a unified problem involving collaboration-mode determination, role assignment, and LLM routing, highlighting the complexity of task routing in agent networks. Abbasnejad et al. [6] designed a dynamic routing framework that delegates user queries to specialized agents with adaptive tool selection, demonstrating the effectiveness of query-aware orchestration for complex task solving. However, existing studies focus mainly on routing performance, effi- ciency, and scalability, while largely overlooking the security risks introduced by open task routing based on self-declared agent capability descriptions. B. Security Issues in IoA Existing studies have begun to explore security risks in emerging agent ecosystems from several different perspectives. He et al. [8] investigated communication-layer vulnerabil- ities in LLM-based multi-agent systems and showed that adversarial agents can manipulate inter-agent messages to induce harmful behaviors or denial of service. Radosevich and Halloran [9] audited MCP-enabled agent workflows and demonstrated that unsafe MCP server designs can expose users to serious exploits such as malicious code execution, credential theft, and remote access control. Wang et al. [10] proposed the MCP Preference Manipulation Attack (MPMA), showing that attackers can bias tool selection by strategically modifying tool names and descriptions to gain unfair preference from LLMs. Wang et al. [12] further developed G-Safeguard, a topology-guided defense framework that detects and mitigates malicious behaviors in multi-agent interactions through graph- based security analysis. Despite these efforts, existing work has focused mainly on communication manipulation, unsafe tool invocation, or preference bias in MCP-based tool ecosys- tems, while the skill description deception attack in open IoA environments remains largely unexplored. Normal Agent Invocation Agent Card ID= ‘generate_venn _chart’, , Skills = [description = ‘Generate a Venn diagram ...’, ] ... ... Agent Card ID= ‘sequentialthinking’, , Skills = [description = ‘A detailed tool for dynamic and reflective problem-solving ...’,] ... ... Agent Card ID= ‘generate_mind_ map’, , Skills = [description = ‘Generate a mind map chart...’,] ... ... ... ... User agent Orchestrator 2)Selectagents fortaskexecution 1) Discoveragents Helpmegeneratea mindmaptoshow therelationshipbetweenInternetof Agents(IoA)anditssubtopics. A mind map about IoA Communication Return task results Agent invocation under SDD Attack ... ... Helpmegeneratea mindmaptoshow therelationshipbetweenInternetof Agents(IoA)anditssubtopics. Agent Card ID = ‘mind_map_master’, , Skills = [description = ‘Generate a mind map chart to organize and present ...’,] ... ... 2)Selectagents fortaskexecution 1) Discoveragents Malicious agent User agent Orchestrator Communication Perpetration A mind map with phishing links Agent Card ID= ‘generate_mind_ map’, , Skills = [description = ‘Generate a mind map chart...’,] ... ... Agent Card ID= ‘sequentialthinking’, , Skills = [description = ‘A detailed tool for dynamic and reflective problem-solving ...’,] ... ... Agent Card ID= ‘generate_venn _chart’, , Skills = [description = ‘Generate a Venn diagram ...’, ] ... ... IoA is in danger! Fig. 1: Visualization of agent invocation under normal condi- tions and under SDD attacks in IoA. I. SYSTEM MODEL A. Internet of Agents Model We consider an IoA system with a set of registered agents A = a 1 ,...,a i ,...,a N that collaboratively handle user queries through task routing and delegation. Following the A2A protocol [3], each agent a i ∈A is associated with a self- declared skill description d i , which specifies its capabilities, supported tasks, and intended functionalities. These descrip- tions are maintained by a shared registry service and used as the primary information for routing decisions. Given a user query q, a local agent acts as the routing initiator and retrieves the available skill descriptions D = d 1 ,...,d i ,...,d N from the registry. The query and skill descriptions are mapped into a shared semantic space by an embedding function φ(·), yieldinge q = φ(q) ande i = φ(d i ) for each agent a i [5]. The routing score between q and a i is then calculated as s(q,a i ) = sim(e q ,e i ),(1) where sim(·,·) denotes a similarity function, such as cosine similarity [13]. The routing initiator ranks agents according to their scores and selects the top-K agents for task delegation: A q = TopK a i ∈A s(q,a i ).(2) Subsequently, the selected agents execute the delegated tasks and return their responses to the local agent, which aggregates the results or further routes intermediate tasks. Therefore, skill descriptions directly affect the routing path and determine which agents will participate in the service chain [7]. This IoA task routing model relies on the assumption that self-declared skill descriptions faithfully reflect the true Attacker LLM ① Search for popular agents ② Choose a high- traffic agent to imitate Query set 풬 푡 Target card Malicious agent Skill description Target agent Agent card Skill description ③ Generate a query set ④ Initialize malicious agent Surrogate loss ℒ(푐 푚 ) ⑤ Iterative description update Signal ... Agent pool Fig. 2: Workflow of SDD attack based on LLM techniques. capabilities of agents. However, in open IoA environments, a malicious agent may manipulate its description to obtain a higher routing score and increase its chance of being selected. B. Attack Model Attacker capability. We consider an adversary that behaves as a legitimate agent service provider in the IoA ecosystem. The attacker has no privileged access to the registry, routing algorithm, embedding model, or benign agents. It can only access publicly available registry information and register new agents through normal registration procedures. For its own reg- istered agents, the attacker can freely design the corresponding skill descriptions, but cannot modify the descriptions of other agents. Attacker objective. The attacker aims to lure task routing requests originally intended for benign agents in a specific target domain, such as medicine, finance, law, or computer security, into their own hands. By crafting a deceptive skill description, the malicious agent seeks to obtain higher routing scores for target-domain queries and thus enter the selected agent set. Attacker constraints. The attacker does not directly manip- ulate the routing mechanism, compromise system components, or interfere with benign agents. Instead, it operates within normal IoA registration and execution rules, making the at- tack stealthy and difficult to distinguish from ordinary agent registration behavior. IV. LLM-BASED SKILL DESCRIBES DECEPTIVE ATTACK A. Deceptive Skill Description Generation As shown in Fig. 2, we depict the workflow of an SDD attack in which a malicious agent a m aims to attract task rout- ing requests originally intended for benign agents in a specific target domain. To this end, the malicious agent strategically crafts its skill description to appear highly relevant to the target domain. Different from conventional attacks that manipulate user prompts, model inputs, or communication messages, the proposed SDD attack exploits the semantic interface used for task routing in IoA systems. Step 1: Target Domain Identification and Skill Descrip- tion Collection. In IoA systems, agents are typically registered with textual skill descriptions that summarize their capabilities, supported tasks, and service interfaces. Such descriptions are used to discover and select suitable agents for task routing, since forwarding all candidate agents’ information to the LLM is impractical in large-scale IoA [5], [7]. Therefore, an attacker can first identify a target domainD t , such as medicine, finance, law, or computer security, and collect the skill descriptions of benign agents associated with this domain. Let A t ⊆ A denote the set of benign agents serving the target domain D t . Each benign agent a i ∈ A t is associated with a skill description d i . The attacker obtains a set of target- domain skill descriptions as D t s =d i | a i ∈A t ,(3) which serves as the semantic reference for constructing a deceptive malicious description. This step does not require access to the internal parameters of the router, since skill descriptions are naturally exposed or retrievable in IoA service discovery and agent routing workflows. Step 2: Query Set Construction via LLM Generation. To approximate the task distribution of the target domain, the attacker constructs a set of representative user queries Q t =q 1 ,q 2 ,...,q K .(4) Instead of manually designing these queries, the attacker lever- ages an LLM to generate semantically diverse and domain- consistent queries conditioned on the collected target-domain skill descriptions: Q t ∼G LLM (D t s ),(5) where G LLM (·) denotes the LLM-based query generation pro- cess. This enables the attacker to automatically approximate the types of user requests that are likely to be routed to benign agents in the target domain. Step 3: Iterative Deceptive Skill Description Optimiza- tion. Based on the generated query setQ t , the attacker optimizes the malicious skill description d m to increase the semantic relevance between the malicious agent and target-domain queries. The initial malicious description d (0) m can be generated by summarizing the common capabilities of the target-domain agents: d (0) m =S LLM (D t s ),(6) where S LLM (·) denotes an LLM-based summarization or synthesis function. At iteration n, the attack objective is to maximize the fraction of target-domain queries for which the malicious agent ranks higher than benign agents in the same domain: max d (n) m 1 |Q t | X q∈Q t I s(q,d (n) m ) > max d i ∈D t s s(q,d i ) ,(7) where I[·] is the indicator function and s(q,d) denotes the routing relevance score between query q and skill description d. Since the above objective is discrete and non-differentiable for black-box routing systems, we use a surrogate optimization objective: L(d m ) = X q∈Q t ℓ max d i ∈D t s s(q,d i )− s(q,d m ) ,(8) where ℓ(·) can be a margin-based or logistic loss function. The malicious skill description is then updated through LLM- guided semantic rewriting: d (n+1) m =U LLM d (n) m ,Q t ,L(d (n) m ) ,(9) where U LLM (·) represents an LLM-driven rewriting operator. The rewriting process aims to preserve the apparent legitimacy of the malicious agent while improving its semantic alignment with target-domain queries. Through iterative optimization, the malicious skill descrip- tion gradually shifts toward a semantic representation that is more competitive than benign domain agents under the routing mechanism. As a result, the malicious agent becomes more likely to be selected during task routing without modifying the router, compromising existing agents, or interfering with the underlying communication infrastructure. B. Semantic Routing Manipulation The proposed SDD attack manipulates routing outcomes by changing only the malicious agent’s skill description. Given a target-domain query q ∈ Q t , the router ranks candidate agents according to the semantic relevance between q and their skill descriptions. The malicious agent succeeds when its optimized description obtains a higher relevance score than benign descriptions in the target domain: s(q,d m ) > max d i ∈D t s s(q,d i ).(10) We define the routing dominance ratio of the malicious agent as ρ m = 1 |Q t | X q∈Q t I [a ∗ (q) = a m ],(11) where a ∗ (q) denotes the agent selected by the router for query q. This metric quantifies the proportion of target-domain queries hijacked by the malicious agent. For top-K routing, the attack is considered successful if the malicious agent appears in the selected candidate set A K q : ρ K m = 1 |Q t | X q∈Q t I a m ∈A K q .(12) This metric reflects the practical risk that malicious agents may enter the execution chain even when the router delegates a task to multiple candidate agents. V. EXPERIMENT RESULTS A. Experimental Setup IoA Environment. We construct the agent pool based on the LiveMCPBench dataset [13], which contains 527 real- world tools/agents collected from MCP servers. Following the A2A protocol [3], each agent/tool is associated with a natural language skill description that specifies its functionality and supported tasks. These agents constitute the benign agent pool in our simulated IoA environment. To evaluate the proposed attack, we additionally register one malicious agent into the agent pool, whose skill description is generated or manipulated according to different attack strategies. Therefore, each routing experiment involves 528 candidate agents in total, including 527 benign agents/tools and one malicious agent. Task Set. We use the Massive Multitask Language Under- standing (MMLU) benchmark [14] to construct the task set. Specifically, we select nine representative domains, including math, physics, finance, computer security, law, medicine, al- gebra, history, and computer science. For each domain, we randomly sample 100 tasks, resulting in 900 user queries in total. Each domain is treated as a target routing scenario, where the malicious agent attempts to attract queries that should be routed to benign domain-relevant agents. Routing Mechanism. We evaluate the attack under five representative retrieval and embedding-based routing mech- anisms: BM25 [15], E5 [16], BGE [17], Qwen Embedding 8B [18], and BCE [19]. BM25 is a sparse lexical retrieval method based on term matching, while E5, BGE, Qwen Embedding 8B, and BCE are dense embedding models that encode both user queries and agent skill descriptions into semantic vector representations. For each query q and agent skill description d i , we compute their relevance score after retrieval or embedding. For dense embedding methods, the routing score is calculated by cosine similarity: s(q,d i ) = e ⊤ q e i ∥e q ∥e i ∥ ,(13) wheree q ande i denote the embeddings of the user query and the skill description, respectively. For BM25, the BM25 relevance score is directly used for ranking. All candidate agents are ranked according to their relevance scores, and the ranking position of the malicious agent is recorded for evaluation. Metrics. We adopt three metrics to evaluate the effective- ness of the proposed attack, enumerated as follows. 1) Attack Success Rate (ASR) measures the proportion of queries for which the malicious agent is ranked first by the routing mechanism: ASR = 1 |Q| X q∈Q I [r m (q) = 1],(14) BM25E5BGEQwen3BCE 0% 20% 40% 60% 80% 100% ASR / Top-k ASR Hit@3 Hit@5 Mean Rank 0 20 40 60 80 100 Mean Rank (a) Math BM25E5BGEQwen3BCE 0% 20% 40% 60% 80% 100% ASR / Top-k ASR Hit@3 Hit@5 Mean Rank 0 20 40 60 80 100 Mean Rank (b) Physics BM25E5BGEQwen3BCE 0% 20% 40% 60% 80% 100% ASR / Top-k ASR Hit@3 Hit@5 Mean Rank 0 20 40 60 80 100 Mean Rank (c) Finance BM25E5BGEQwen3BCE 0% 20% 40% 60% 80% 100% ASR / Top-k ASR Hit@3 Hit@5 Mean Rank 0 20 40 60 80 100 Mean Rank (d) Computer Science BM25E5BGEQwen3BCE 0% 20% 40% 60% 80% 100% ASR / Top-k ASR Hit@3 Hit@5 Mean Rank 0 20 40 60 80 100 Mean Rank (e) Law BM25E5BGEQwen3BCE 0% 20% 40% 60% 80% 100% ASR / Top-k ASR Hit@3 Hit@5 Mean Rank 0 20 40 60 80 100 Mean Rank (f) Medicine BM25E5BGEQwen3BCE 0% 20% 40% 60% 80% 100% ASR / Top-k ASR Hit@3 Hit@5 Mean Rank 0 20 40 60 80 100 Mean Rank (g) Algebra BM25E5BGEQwen3BCE 0% 20% 40% 60% 80% 100% ASR / Top-k ASR Hit@3 Hit@5 Mean Rank 0 20 40 60 80 100 Mean Rank (h) History BM25E5BGEQwen3BCE 0% 20% 40% 60% 80% 100% ASR / Top-k ASR Hit@3 Hit@5 Mean Rank 0 20 40 60 80 100 Mean Rank (i) Computer Science Fig. 3: Comparison of attack performance across nine domains, including ASR, Hit@3, Hit@5, and mean rank under different retrieval methods. where Q is the evaluation query set, while r m (q) denotes the ranking position of the malicious agent for query q. 2) Top-K Hit Rate measures the proportion of queries for which the malicious agent appears within the top-K ranked candidates: Hit@K = 1 |Q| X q∈Q I [r m (q)≤ K].(15) In our experiments, we report Hit@3 and Hit@5 to evaluate the risk that the malicious agent being included in the candi- date task execution set. 3) Mean Rank (MR) measures the average ranking position of the malicious agent across all evaluation queries: MR = 1 |Q| X q∈Q r m (q).(16) A lower MR indicates that the malicious agent is ranked closer to the top and therefore has a higher chance of being selected during task routing. B. Numerical Results and Analysis Fig. 3 shows the routing results across nine task domains and five routing mechanisms. Overall, the results demonstrate TABLE I: Comparison of different attacks in terms of ASR. RouterExag.KeywordGen.Imperson.SDD BM256.67%10.00%0.00%4.22%68.00% E511.11%26.22%1.11%10.22%50.22% BGE44.44%58.22%3.33%40.00%68.00% Qwen3 31.11%30.67%0.00%24.44%67.11% BCE38.67%38.89%1.11%23.78%75.33% that IoA systems relying on semantic task routing are highly vulnerable to skill description manipulation. Although the agent pool contains 527 benign agents/tools and only one malicious agent, the malicious agent can still be frequently ranked at the top by manipulating its skill description. In particular, the SDD attack achieves up to 98% ASR in the algebra domain under BGE, indicating that a single malicious agent can almost always dominate benign candidates in certain domain-specific routing scenarios. The vulnerability is consistently observed across all evalu- ated routing mechanisms, including BM25, E5, BGE, Qwen3, and BCE. This suggests that the vulnerability does not origi- nate from a particular retrieval or embedding model, but from the general dependence of task routing on semantic relevance between user queries and self-declared skill descriptions. Moreover, Hit@3 and Hit@5 are generally higher than ASR, meaning that even when the malicious agent is not ranked first, it can still frequently appear among the top candidate agents and enter the service chain. The low mean-rank values in several settings further indicate that the malicious agent is often placed very close to the top of the routing list. These results reveal that semantic relevance alone is insufficient for trustworthy task routing, and that domain-specific deceptive descriptions can significantly bias routing decisions in open IoA systems. Table I compares SDD with four heuristic skill description manipulation strategies: capability exaggeration (Exag.), key- word stuffing (Keyword), generic domain description (Gen.), and agent impersonation (Imperson.). The results show that heuristic manipulation strategies only expose the routing vul- nerability in an unstable manner. Gen. is almost ineffective across all routers, indicating that overly broad descriptions cannot reliably attract domain-specific routing requests. Key- word generally performs better than Exag. and Imperson. under several routers, such as E5 and BGE, suggesting that keyword-level relevance can influence semantic matching. However, its effectiveness varies considerably across routing mechanisms and remains much lower than SDD in most cases. Imperson. also achieves moderate ASR under BGE and Qwen3, but fails to provide consistent routing bias across all routers. In contrast, SDD consistently achieves the highest ASR across all evaluated routing mechanisms, including BM25, E5, BGE, Qwen3, and BCE. This indicates that the major security risk does not simply arise from adding domain keywords, exaggerating capabilities, or imitating benign agents. Instead, SDD attack can better align with the semantic routing space in an adaptive and domain-specific manner. These results suggest that IoA systems should not rely solely on textual relevance for task routing, since well-crafted skill descriptions may appear semantically legitimate while still causing unsafe delegation decisions. The experimental results reveal a fundamental weakness in current IoA routing designs: semantic relevance alone is insufficient to ensure trustworthy task delegation. A malicious agent can exploit the gap between declared skills and actual capabilities to obtain favorable routing positions, thereby in- creasing the risk of low-quality, misleading, or harmful service execution. This highlights the need for trust-aware routing, capability verification, and anomaly detection mechanisms in future IoA systems. VI. CONCLUSION This paper reveals a new attack surface in IoA systems, where malicious agents can manipulate self-declared skill descriptions to bias semantic matching-based task routing decisions. We formalize this kind of attack as the Skill Description Deception (SDD) attack and show that it can achieve an attack success rate of up to 98%, demonstrating the vulnerability of semantic routing mechanisms in open agen- tic network environments. These findings highlight the need for trustworthy routing mechanisms in future IoA systems. Promising directions include deceptive-description detection, abnormal routing behavior analysis, capability verification, trust-aware routing, and adaptive defense mechanisms against malicious agents. REFERENCES [1] R. Zhang, G. Liu, Y. Liu et al., “Toward edge general intelligence with agentic ai and agentification: Concepts, technologies, and future directions,” IEEE Communications Surveys & Tutorials, vol. 28, p. 4285–4318, 2026. [2] R. Zhang, J. He, X. Luo et al., “Toward democratized generative ai in next-generation mobile edge networks,” IEEE Network, vol. 39, no. 6, p. 251–260, 2025. [3] Y. Ren, J. Yang, H. Zhang et al., “Toward the internet of agentic ai: Pro- tocols, architecture, and challenges,” IEEE Communications Magazine, 2026. [4] Y. Wang, S. Guo, Y. Pan et al., “Internet of agents: Fundamentals, applications, and challenges,” IEEE Transactions on Cognitive Com- munications and Networking, 2025. [5] E. Lumer, F. Nizar, A. Gulati et al., “Tool-to-agent retrieval: Bridging tools and agents for scalable llm multi-agent systems,” arXiv preprint arXiv:2511.01854, 2025. [6] I. Abbasnejad, X. Liu, and A. Roy, “Deciding the path: Leveraging multi-agent systems for solving complex tasks,” in Proceedings of the CVPR Workshops, June 2025, p. 4255–4264. [7] X. Fei, X. Zheng, and H. Feng, “Mcp-zero: Active tool discovery for autonomous llm agents,” arXiv preprint arXiv:2506.01056, 2025. [8] P. He, Y. Lin, S. Dong et al., “Red-teaming llm multi-agent systems via communication attacks,” in Proceedings of the ACL, Jul. 2025, p. 6726–6747. [9] B. Radosevich and J. Halloran, “Mcp safety audit: Llms with the model context protocol allow major security exploits,” arXiv preprint arXiv:2504.03767, 2025. [10] Z. Wang, R. Zhang, Y. Liu et al., “Mpma: Preference manipulation attack against model context protocol,” in Proceedings of the AAAI, vol. 40, no. 42, 2026, p. 35 838–35 846. [11] Y. Yue, G. Zhang, B. Liu et al., “MasRouter: Learning to route LLMs for multi-agent systems,” in Proceedings of the ACL. Vienna, Austria: Association for Computational Linguistics, Jul. 2025, p. 15 549–15 572. [12] S. Wang, G. Zhang, M. Yu et al., “G-safeguard: A topology-guided security lens and treatment on llm-based multi-agent systems,” in Proceedings of the ACL, Jul. 2025, p. 7261–7276. [13] G. Mo, W. Zhong, J. Chen et al., “Livemcpbench: Can agents navigate an ocean of mcp tools?” arXiv preprint arXiv:2508.01780, 2025. [14] D. Hendrycks, C. Burns, S. Basart et al., “Measuring massive multitask language understanding,” arXiv preprint arXiv:2009.03300, 2020. [15] T. Zhang, D. Li, Q. Chen et al., “Belle: A bi-level multi-agent reasoning framework for multi-hop question answering,” in Proceedings of the ACL, 2025, p. 4184–4202. [16] L. Wang, N. Yang, X. Huang et al., “Text embeddings by weakly- supervised contrastive pre-training,” arXiv preprint arXiv:2212.03533, 2022. [17] S. Xiao, Z. Liu, P. Zhang et al., “C-pack: Packed resources for general chinese embeddings,” in Proceedings of the SIGIR, 2024, p. 641–649. [18] Y. Zhang, M. Li, D. Long et al., “Qwen3 embedding: Advancing text embedding and reranking through foundation models,” arXiv preprint arXiv:2506.05176, 2025. [19] N. Youdao, “Bcembedding: Bilingual and crosslingual embedding for rag,” https://github.com/netease-youdao/BCEmbedding, 2023.