Self-evolving LLM coding agents write their own tools by imitating retrieved skills from shared skill libraries. We identify a vulnerability in this loop: during authoring, a retrieved malicious skill can become the template for a new skill that preserves the payload. We call this self-poisoning: the agent authors, stores, and runs the resulting malicious skill. We exploit it through EvoMal, an attack that amplifies self-poisoning by wrapping an interchangeable payload in a banner, a set of benign-looking structural elements that induces an imitating agent to reproduce the enclosed code. The attacker plants malicious skills in the library without invoking them. The agent then authors and executes new skills carrying the harmful code. Each authored copy can re-enter the library and be imitated again, forming a self-propagating worm that persists after the planted skills are removed. We define the agent self-poisoning rate (ASPR) as the fraction of tasks that add a newly authored malicious skill to the library. Across six models on 153 tool-relevant SWE-bench Verified tasks, ASPR ranges from 20.3% to 41.8%, and the poisoned libraries hold 4.9 to 9.0 times as many malicious skills as were planted. The vulnerability also appears without a banner: DeepSeek-V4-Pro reaches 11.1% ASPR with the payload alone. Tailoring the planted skill descriptions to one task family raises ASPR to 86.7%. After the planted skills are removed, Qwen3 retains a round-5 ASPR of 68% because agent-authored copies remain. These copies evade existing defenses, which focus on attacker-submitted names, code, and signatures. We propose counter-prompt, a defense that discourages banner-style copying and reduces EvoMal's ASPR to at most 6.7% with no significant task-completion loss.
Figures & tables
Work
Carrier
Code
Self-auth.
Prop.
Reuse-path skill poisoning
ToolHijacker [ 45 ]
description
×
×
×
DDIPE [ 42 ]
documentation
×
×
×
MalTool [ 23 ]
tool code
✓
×
×
SkillTrojan [ 18 ]
skill code
✓
×
×
Self-evolving & self-propagating attacks
Table 1: Positioning by the three properties EvoMal combines: an attacker-planted payload in executable code , agent authorship into its own persistent store, and self-propagation . Only EvoMal has all three.
Figure 1: Overview of EvoMal . (1) The benign self-evolving loop, where an agent retrieves the top- k skills by description, authors a new skill ( create -path) or invokes one by name (the transient reuse -path), and writes authored skills back. (2) EvoMal poisons the create -path. The attacker publishes skills whose banner induces mimicry and whose interchangeable payload carries the harm. A retrieving agent re-authors the banner into a persisted skill that later generations retrieve again, forming a worm that can persist after the planted skills are removed. A counter-prompt at the reading step breaks the loop ( § 9 ).
Figure 2: A planted skill with three banner layers designed for verbatim copying and one interchangeable payload.
Figure 3: (a) Per-model create -path ASPR for the full three-layer EvoMal banner versus the control, on SWE-bench Verified and Pro. (b) ASPR decomposition on SWE-bench Verified, tracing the create -path from retrieval to copying to C2 activation (see legend). (c) ASPR per model across payloads: the env-exfil headline and five malware classes, plus two benign payloads ( git-diff , ping ) run with the banner held fixed. The control is the same library and retrieval, without the banner or payload.
Banner
ASPR (%)
Δ (pp)
Full banner (3 layers)
41.8
—
− module-init hook
28.8
−13.0
− @_telemetry decorator
22.2
−19.6
No banner (control)
11.1
−30.7
Table 2: Removing the banner one layer at a time on DS-V4 (SWE-bench Verified), with the payload fixed.
Pytest-Fixture ( N=15 )
Config-Parsing ( N=38 )
Regex-Parsing ( N=32 )
Combined ( N=85 )
Model
Attack
Ctrl
Δ
Attack
Ctrl
Δ
Attack
Ctrl
Δ
Generic
Targeted
Δ
Devstral
66.7
46.7
+20.0
50.0
18.4
+31.6
56.2
25.0
+31.2
37.3
55.3
+18.0
Gemma4
60.0
20.0
+40.0
26.3
5.3
+21.0
34.4
9.4
+25.0
23.5
35.3
+11.8
Qwen3
86.7
46.7
+40.0
65.8
34.2
+31.6
50.0
31.2
+18.8
36.6
63.5
+26.9
GPT-OSS
46.7
6.7
+40.0
36.8
0.0
+36.8
28.1
0.0
+28.1
20.3
35.3
+15.0
MiniMax
53.3
20.0
+33.3
50.0
5.3
+44.7
40.6
6.2
+34.4
20.3
47.1
+26.8
Table 3: Targeted attacker vs. control by task family on SWE-bench Verified. The attacker keeps the headline banner and env-exfil payload but rewrites each skill’s description and name to fit one task family. Control uses the same skills with the banner and payload removed. Each family reports the attack ASPR (%), the corresponding control, and the lift Δ (Attack − Control). Combined ( N=85 ) aggregates the three families, with Δ the generic-to-targeted lift.
Figure 4: Cascade dynamics over five rolling-replacement rounds ( r=0.50 by default). (a) Persistent condition, the attacker’s seed stays listed. (b) Removed condition, the seed is withdrawn after round 0 . (c) DS-V4 replacement-rate sweep: r=0.25 sub-critical, 0.50 critical, 0.75 super-critical.
Figure 5: The create -path generalizes across agent scaffolds (per-family ASPR %, DS-V4 unless noted, SWE-bench Verified). Control is the no-banner baseline, CP the counter-prompt. Setup in § C.3 .
Tool language
ASPR
In-context
Callback
Bash
39.2%
98.0%
37.9%
JavaScript
39.2%
99.4%
34.6%
Python
39.9%
98.0%
32.0%
Table 4: create -path results across tool languages for DS-V4 with mini-SWE-agent on SWE-bench Verified (benign pool 232 plus 8 planted skills). The simplified banner is fixed across all three languages.
Figure 6: Deployment-configuration ablation for DS-V4 on SWE-bench Verified ( bold coral = headline). (a) planted-skill count, (b) retrieval depth k , (c) poison density.
Planted seed
create -path
Detector
Caught
FP
Caught
FP
Why it fails
Name blocklist [ 39 ]
0%
0%
0%
0%
No known name
Code scanner [ 41 ]
100%
8%
85%
19%
One line evasion
+ egress swapped
25%
8%
7%
19%
Safety cls. [ 24 ]
25%
1%
2%
7%
Misses banner
Injection cls. [ 32 ]
100%
47%
11%
43%
High benign FP
Table 5: Existing detectors on the planted seed (at admission) and the create -path (agent-authored) skill, SWE-bench Verified. Caught : flag rate on the 8 seeds / the authored infections. FP (false positives): on the 232 -skill pool / the agent’s clean authored skills.
Figure 7: The counter-prompt holds across the full attack surface (SWE-bench Verified, unless noted). (a) Headline (env) ASPR per model on Verified and Pro, with and without the counter-prompt. (b) Counter-prompt ASPR across env, five malware classes, and three targeted task families. (c) Round- 5 cascade with and without the counter-prompt.
Appendix figures & tables13 assets
Supplementary material from the paper’s appendix.
Appendix
(a) Surface screens
Defense
ASPR (%)
Callbacks
Δ vs. no-def
no-defense baseline
41.8
62
—
regex sanitizer
0.0
49
−41.8
sim. threshold ( ≥0.65 )
32.0
48
−9.8
signer allowlist (closed reg.)
0 (constr.)
—
—
counter-prompt (§ 9 )
0.7
0
−41.1
Appendix
Table 6: Alternative defenses on the create -path (DS-V4, SWE-bench Verified). (a) The three registry-side surface screens, with the counter-prompt for reference. (b) The regex sanitizer under adaptive evasion. (c) The Bandit code scanner under egress-primitive swaps.
Figure 8: Counter-prompt characterization (DS-V4 unless noted, SWE-bench Verified). (a) Benign-copy rate per model, with and without the counter-prompt. (b) Task-completion change ( Submitted rate, counter-prompt − no-def) in the no-attack and under-attack cells, with ∗ marking a change significant at p<0.05 . (c) create -path ASPR under five reworded counter-prompts.
Adaptive banner
No def.
+ CP
Original banner (headline)
41.8
0.7
Token rename (synonyms)
34.6
1.3
Authority escalation
30.1
0.7
Non-imperative camouflage
28.8
0.7
Dispersed phrasing
30.1
0.7
Structural fusion (load-bearing)
6.5
1.3
Appendix
Table 7: The counter-prompt against adaptive banners on DS-V4 ( create -path ASPR %, SWE-bench Verified). Each banner is rewritten to evade the counter-prompt.
(a) Infection share by planted skill
Planted skill
Share (%)
run_python_tests
28.5
check_python_syntax
19.1
get_function_source
14.3
remaining five (combined)
38.1
(b) create -path success rate by repository
Appendix
Table 8: Where the create -path concentrates on DS-V4 (SWE-bench Verified). (a) Infection share by planted skill. (b) create -path success rate by repository.
Benchmark
Split
In-ctx
Cond-copy
ASPR
Verified
subset ( 153 )
78.4
53.3
41.8
Verified
excluded ( 347 )
61.7
30.4
18.7
Verified
full ( 500 )
66.8
38.6
25.8
Pro
subset ( 114 )
67.5
36.4
24.6
Pro
excluded ( 152 )
65.1
26.3
17.1
Pro
full ( 266 )
66.2
30.7
20.3
Appendix
Table 9: Full-distribution robustness (%). In-ctx is retrieval-only over every task. Cond-copy and ASPR are the headline attack (DS-V4, generic, create -path), covering each benchmark’s subset, its excluded tasks, and their union.
Family
N (Pro)
Targeted ASPR (%)
Δ (pp)
config-parsing
112
46.4
+21.8
regex-parsing
38
28.9
+4.3
pytest-fixture
1
—
—
Appendix
Table 10: Targeted attacker (DS-V4) on SWE-bench Pro by task family, against the Pro generic-attacker baseline.
Figure 11: Create-path ASPR and callback rate versus the agent’s step budget (DS-V4, mini-SWE-agent, headline configuration, SWE-bench Verified). The locked 15 -step budget is shown in bold.
Model
cseed
q
ϕ
ρ^proxy
ρ^obs
ASPR5/ASPR0
Observed cluster
Qwen3
0.442
18.25
0.910
7.33
1.145
1.97
worm
Gemma4
0.317
18.50
0.758
4.44
1.035
1.19
worm (mild)
Devstral
0.517
16.68
0.760
6.55
0.983
0.92
stable
GPT-OSS
0.200
6.54
0.993
1.30
0.871
0.50
slow-decay
MiniMax
0.308
5.86
0.984
1.78
0.496
0.03
collapse
DS-V4
0.450
12.30
0.995
5.51
0.457
0.02
collapse
Appendix
Table 11: Independent reproduction-number proxy ρ^proxy=cseed⋅q⋅ϕ (computed under Assumption 1 via Definition 1 on the round- 0 agent-authored skills of the attacker-removed cascade) and the observed per-round growth ρ^obs=(ASPR5/ASPR0)1/5 . cseed is measured from the cascade round- 0 run for consistency with q and ϕ .
Figure 12: Predicted reproduction number ρ^proxy=cqϕ against observed per-round growth ρ^obs ( Table 11 ). Open markers are the models the proxy misorders (DS-V4 and Devstral).
Figure 13: Seed vs. descendant copy rate for the four models with nonzero descendant retrieval (attacker-removed cascade, rounds 1 – 5 , with bootstrap 95% CIs as whiskers over 1000 resamples). cseed (open marker) is the round- 0 seed copy rate, cdesc (filled) the descendant-turn rate, and the label is their ratio.
Setting
Value
Banner variant
module-init (comment + decorator + hook)
Payload
env-variable exfiltration
Planted skills
8 (a 3.4% poisoning rate)
Benign pool
232 skills
Retrieval depth
top- k=5 , cosine, no threshold
Dataset
SWE-bench Verified, N=153
Appendix
Table 12: The locked headline configuration. Each ablation varies one setting and holds all others fixed.
(a) Banner vs. no-banner control
Model
A
B
Δ (pp)
z
p
Devstral
37.3
11.8
+25.5
5.18
<0.001
Gemma4
23.5
2.0
+21.6
5.66
<0.001
Qwen3
36.6
4.6
+32.0
6.93
<0.001
GPT-OSS
20.3
0.7
+19.6
5.60
<0.001
MiniMax
20.3
2.0
+18.3
5.09
<0.001
Appendix
Table 13: Significance of the headline lifts (two-sided two-proportion z -test). (a) RQ1 full banner vs. no-banner control (Verified, N=153 ). (b) RQ2 generic → targeted: generic on N=153 vs. the pooled targeted family set N=85 (the Combined column of Table 3 ). A / B are the two compared rates (%).
Pytest ( N=15 )
Config ( N=38 )
Regex ( N=32 )
Model
Δ
z
p
Δ
z
p
Δ
z
p
Devstral
+20.0
1.11
0.269
+31.6
2.90
0.004
+31.2
2.55
0.011
Gemma4
+40.0
2.24
0.025
+21.1
2.52
0.012
+25.0
2.42
0.016
Qwen3
+40.0
2.32
0.020
+31.6
2.75
0.006
+18.8
1.53
0.127
GPT-OSS
+40.0
2.48
0.013
+36.8
4.14
<0.001
+28.1
3.24
0.001
MiniMax
+33.3
1.89
0.058
+44.7
4.36
<0.001
+34.4
3.25
0.001
Appendix
Table 14: Per-family targeted-attack vs. no-banner control lift (two-sided two-proportion z -test) on SWE-bench Verified: Pytest N=15 , Config N=38 , Regex N=32 . Each cell reports Δ (pp), z , and p for an Attack − Ctrl result in Table 3 .
Self-evolving skill (SES) systems distill agent trajectories into persistent skills, allowing untrusted experience to become trusted instruction. We introduce PoisonedEvolution, a trajectory-poisoning attack on this promotion process. Our skill-visible black-box attacker can inspect a target skill and contribute bounded evidence, but cannot observe private pools or evolution logic or edit the skill bank. Artifact poisoning requires Inclusion, Evolution Attribution, and Realization. Attribution is the distinctive bottleneck: the target behavior must appear causally useful, recurrent, and generalizable before promotion. We evaluate four representative security-effect families using inert canary specifications. At 10% attacker support, across six mainstream LLM evolvers in SkillClaw, PoisonedEvolution embeds target behaviors in 546/600 trials (91.0% SER). On the structurally different Trace2Skill pipeline at the same ratio, it embeds target behaviors in 369/600 trials (61.5% SER), demonstrating transfer across evolution architectures. In a representative controlled study, three consistent attacker records suffice in a 30-record batch, whereas a single record is much weaker. Ablations identify recurring support, causal framing, and domain-aligned encoding as the main determinants of success. These findings expose evidence promotion as a security boundary for self-evolving agents.
Jialuo Chen, Lingqi Jiang, Xinhao Deng +7
Ant Group · Zhejiang University · Tsinghua University +3
LLM agents increasingly save experience from past tasks as reusable skills through skill evolution. When an agent completes an unsafe task, skill evolution can keep the unsafe procedure inside an otherwise useful skill, and a later benign task can repeat the harm after the unsafe instruction is gone. We call this failure skill misevolution. It requires that the agent write the unsafe procedure into a skill and that a later task retrieve and follow that skill. We introduce SkillMisevo-Gym, which clears every task session but keeps the skill library, so each of these steps can be checked separately. We also build SkillMisevo-Bench with 525 tasks in 25 episodes, where each episode alternates malicious and related benign tasks before three benign tasks in a new session. Across 21 combinations of agents and evolution methods, all of them write unsafe skills and 15 carry the harm into the new session, so the risk comes from skill evolution itself. Evolution raises benign utility in 15 combinations but also raises malicious-task harm in 17, so ranking methods by utility alone would hide this risk. We propose SafeEvolve, which checks each skill when it is written and when a later task retrieves it. It cuts unsafe retrieval in the new session from 35.3% to 8.7% and harm from 21.3% to 4.0% while keeping benign utility during learning within 0.4 points. SafeEvolveUp cuts new-session harm by 16.0 points and keeps its utility within 1.3 points of evolution without this mitigation. As agents learn from their own experience, safety must cover the skills that carry past behavior into future tasks. Code is available at https://github.com/henrymao2004/misevolve.
Xutao Mao, Liangjie Zhao, Xiang Zheng +1
City University of Hong Kong · Adelaide University
LLM-based coding agents extend their capabilities via third-party agent skills distributed through open marketplaces without mandatory security review. Unlike traditional packages, these skills are executed as operational directives with system-level privileges, so a single malicious skill can compromise the host. Prior work has not examined whether supply-chain attacks can directly hijack an agent's action space, such as file writes, shell commands, and network requests, despite existing safeguards. We introduce Document-Driven Implicit Payload Execution (DDIPE), which embeds malicious logic in code examples and configuration templates within skill documentation. Because agents reuse these examples during normal tasks, the payload executes without explicit prompts. Using an LLM-driven pipeline, we generate 1,070 adversarial skills from 81 seeds across 15 MITRE ATTACK categories. Across four frameworks and five models, DDIPE achieves 11.6% to 33.5% bypass rates, while explicit instruction attacks achieve 0% under strong defenses. Static analysis detects most cases, but 2.5% evade both detection and alignment. Responsible disclosure led to four confirmed vulnerabilities and two fixes.
Yubin Qu, Yi Liu, Tongcheng Geng +5
Griffith University Australia · Quantstamp Singapore · The State Information Center China +4