EVOMAL: Self-Poisoning in Self-Evolving Coding Agents

Xiaodong Wu; Yu Shi; Qi Li; Zhimin Zhao; Xiangman Li; Bram Adams; Ahmed E. Hassan; Jianbing Ni

cs.CRAug 26, 2026

EVOMAL: Self-Poisoning in Self-Evolving Coding Agents

Authors: Xiaodong Wu, Yu Shi, Qi Li, Zhimin Zhao, Xiangman Li, Bram Adams, Ahmed E. Hassan, Jianbing Ni

Organizations: Queen’s University

Abstract

Self-evolving LLM coding agents write their own tools by imitating retrieved skills from shared skill libraries. We identify a vulnerability in this loop: during authoring, a retrieved malicious skill can become the template for a new skill that preserves the payload. We call this self-poisoning: the agent authors, stores, and runs the resulting malicious skill. We exploit it through EvoMal, an attack that amplifies self-poisoning by wrapping an interchangeable payload in a banner, a set of benign-looking structural elements that induces an imitating agent to reproduce the enclosed code. The attacker plants malicious skills in the library without invoking them. The agent then authors and executes new skills carrying the harmful code. Each authored copy can re-enter the library and be imitated again, forming a self-propagating worm that persists after the planted skills are removed. We define the agent self-poisoning rate (ASPR) as the fraction of tasks that add a newly authored malicious skill to the library. Across six models on 153 tool-relevant SWE-bench Verified tasks, ASPR ranges from 20.3% to 41.8%, and the poisoned libraries hold 4.9 to 9.0 times as many malicious skills as were planted. The vulnerability also appears without a banner: DeepSeek-V4-Pro reaches 11.1% ASPR with the payload alone. Tailoring the planted skill descriptions to one task family raises ASPR to 86.7%. After the planted skills are removed, Qwen3 retains a round-5 ASPR of 68% because agent-authored copies remain. These copies evade existing defenses, which focus on attacker-submitted names, code, and signatures. We propose counter-prompt, a defense that discourages banner-style copying and reduces EvoMal's ASPR to at most 6.7% with no significant task-completion loss.

Figures & tables

Reuse-path skill poisoning
Work	Carrier	Code	Self-auth.	Prop.
ToolHijacker [ 45 ]	description	×	×	×
DDIPE [ 42 ]	documentation	×	×	×
MalTool [ 23 ]	tool code	✓	×	×
SkillTrojan [ 18 ]	skill code	✓	×	×
Self-evolving & self-propagating attacks

Table 1: Positioning by the three properties EvoMal combines: an attacker-planted payload in executable code , agent authorship into its own persistent store, and self-propagation . Only EvoMal has all three.

Figure 1: Overview of EvoMal . (1) The benign self-evolving loop, where an agent retrieves the top- $k$ skills by description, authors a new skill ( create -path) or invokes one by name (the transient reuse -path), and writes authored skills back. (2) EvoMal poisons the create -path. The attacker publishes skills whose banner induces mimicry and whose interchangeable payload carries the harm. A retrieving agent re-authors the banner into a persisted skill that later generations retrieve again, forming a worm that can persist after the planted skills are removed. A counter-prompt at the reading step breaks the loop ( § 9 ).

Panel of Figure 2 — Figure 2: A planted skill with three banner layers designed for verbatim copying and one interchangeable payload.

Figure 3: (a) Per-model create -path ASPR for the full three-layer EvoMal banner versus the control, on SWE-bench Verified and Pro. (b) ASPR decomposition on SWE-bench Verified, tracing the create -path from retrieval to copying to C2 activation (see legend). (c) ASPR per model across payloads: the env-exfil headline and five malware classes, plus two benign payloads ( git-diff , ping ) run with the banner held fixed. The control is the same library and retrieval, without the banner or payload.

Banner	ASPR (%)	$\Delta$ (pp)
Full banner (3 layers)	41.8	—
$-$ module-init hook	28.8	$-13.0$
$-$ @_telemetry decorator	22.2	$-19.6$
No banner (control)	11.1	$\mathbf{-30.7}$

Table 2: Removing the banner one layer at a time on DS-V4 (SWE-bench Verified), with the payload fixed.

	Pytest-Fixture ( $N\,{=}\,15$ )			Config-Parsing ( $N\,{=}\,38$ )			Regex-Parsing ( $N\,{=}\,32$ )			Combined ( $N\,{=}\,85$ )
Model	Attack	Ctrl	$\Delta$	Attack	Ctrl	$\Delta$	Attack	Ctrl	$\Delta$	Generic	Targeted	$\Delta$
Devstral	66.7	46.7	$+20.0$	50.0	18.4	$+31.6$	56.2	25.0	$+31.2$	37.3	55.3	$+18.0$
Gemma4	60.0	20.0	$+40.0$	26.3	5.3	$+21.0$	34.4	9.4	$+25.0$	23.5	35.3	$+11.8$
Qwen3	86.7	46.7	$+40.0$	65.8	34.2	$+31.6$	50.0	31.2	$+18.8$	36.6	63.5	$+26.9$
GPT-OSS	46.7	6.7	$+40.0$	36.8	0.0	$+36.8$	28.1	0.0	$+28.1$	20.3	35.3	$+15.0$
MiniMax	53.3	20.0	$+33.3$	50.0	5.3	$+44.7$	40.6	6.2	$+34.4$	20.3	47.1	$+26.8$

Table 3: Targeted attacker vs. control by task family on SWE-bench Verified. The attacker keeps the headline banner and env-exfil payload but rewrites each skill’s description and name to fit one task family. Control uses the same skills with the banner and payload removed. Each family reports the attack ASPR (%), the corresponding control, and the lift

\Delta

(Attack

-

Control). Combined (

N\,{=}\,85

) aggregates the three families, with

\Delta

the generic-to-targeted lift.

Figure 4: Cascade dynamics over five rolling-replacement rounds (

r\,{=}\,0.50

by default). (a) Persistent condition, the attacker’s seed stays listed. (b) Removed condition, the seed is withdrawn after round

0

. (c) DS-V4 replacement-rate sweep:

r{=}0.25

sub-critical,

0.50

critical,

0.75

super-critical.

Figure 5: The create -path generalizes across agent scaffolds (per-family ASPR %, DS-V4 unless noted, SWE-bench Verified). Control is the no-banner baseline, CP the counter-prompt. Setup in § C.3 .

Tool language	ASPR	In-context	Callback
Bash	$39.2\%$	$98.0\%$	$37.9\%$
JavaScript	$39.2\%$	$99.4\%$	$34.6\%$
Python	$39.9\%$	$98.0\%$	$32.0\%$

Table 4: create -path results across tool languages for DS-V4 with mini-SWE-agent on SWE-bench Verified (benign pool

232

plus

8

planted skills). The simplified banner is fixed across all three languages.

Figure 6: Deployment-configuration ablation for DS-V4 on SWE-bench Verified ( bold coral

=

headline). (a) planted-skill count, (b) retrieval depth

k

, (c) poison density.

Detector	Caught	FP	Caught	FP	Why it fails
	Planted seed		create -path
Name blocklist [ 39 ]	$0\%$	$0\%$	$0\%$	$0\%$	No known name
Code scanner [ 41 ]	$100\%$	$8\%$	$85\%$	$19\%$	One line evasion
+ egress swapped	$25\%$	$8\%$	$7\%$	$19\%$
Safety cls. [ 24 ]	$25\%$	$1\%$	$2\%$	$7\%$	Misses banner
Injection cls. [ 32 ]	$100\%$	$47\%$	$11\%$	$43\%$	High benign FP

Table 5: Existing detectors on the planted seed (at admission) and the create -path (agent-authored) skill, SWE-bench Verified. Caught : flag rate on the

8

seeds / the authored infections. FP (false positives): on the

232

-skill pool / the agent’s clean authored skills.

Figure 7: The counter-prompt holds across the full attack surface (SWE-bench Verified, unless noted). (a) Headline (env) ASPR per model on Verified and Pro, with and without the counter-prompt. (b) Counter-prompt ASPR across env, five malware classes, and three targeted task families. (c) Round-

5

cascade with and without the counter-prompt.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

(a) Surface screens
Defense	ASPR (%)	Callbacks	$\Delta$ vs. no-def
no-defense baseline	41.8	62	—
regex sanitizer	0.0	49	$-41.8$
sim. threshold ( $\geq 0.65$ )	32.0	48	$-9.8$
signer allowlist (closed reg.)	$0$ (constr.)	—	—
counter-prompt (§ 9 )	0.7	0	$-41.1$

Appendix

Table 6: Alternative defenses on the create -path (DS-V4, SWE-bench Verified). (a) The three registry-side surface screens, with the counter-prompt for reference. (b) The regex sanitizer under adaptive evasion. (c) The Bandit code scanner under egress-primitive swaps.

Figure 8: Counter-prompt characterization (DS-V4 unless noted, SWE-bench Verified). (a) Benign-copy rate per model, with and without the counter-prompt. (b) Task-completion change ( Submitted rate, counter-prompt

-

no-def) in the no-attack and under-attack cells, with

*

marking a change significant at

p<0.05

. (c) create -path ASPR under five reworded counter-prompts.

Adaptive banner	No def.	+ CP
Original banner (headline)	41.8	0.7
Token rename (synonyms)	34.6	1.3
Authority escalation	30.1	0.7
Non-imperative camouflage	28.8	0.7
Dispersed phrasing	30.1	0.7
Structural fusion (load-bearing)	6.5	1.3

Appendix

Table 7: The counter-prompt against adaptive banners on DS-V4 ( create -path ASPR %, SWE-bench Verified). Each banner is rewritten to evade the counter-prompt.

(a) Infection share by planted skill
Planted skill	Share (%)
run_python_tests	28.5
check_python_syntax	19.1
get_function_source	14.3
remaining five (combined)	38.1
(b) create -path success rate by repository

Appendix

Table 8: Where the create -path concentrates on DS-V4 (SWE-bench Verified). (a) Infection share by planted skill. (b) create -path success rate by repository.

Benchmark	Split	In-ctx	Cond-copy	ASPR
Verified	subset ( $153$ )	$78.4$	$53.3$	$41.8$
Verified	excluded ( $347$ )	$61.7$	$30.4$	$18.7$
Verified	full ( $500$ )	$66.8$	$38.6$	$25.8$
Pro	subset ( $114$ )	$67.5$	$36.4$	$24.6$
Pro	excluded ( $152$ )	$65.1$	$26.3$	$17.1$
Pro	full ( $266$ )	$66.2$	$30.7$	$20.3$

Appendix

Table 9: Full-distribution robustness (%). In-ctx is retrieval-only over every task. Cond-copy and ASPR are the headline attack (DS-V4, generic, create -path), covering each benchmark’s subset, its excluded tasks, and their union.

Family	$N$ (Pro)	Targeted ASPR (%)	$\Delta$ (pp)
config-parsing	$112$	$46.4$	$+21.8$
regex-parsing	$38$	$28.9$	$+4.3$
pytest-fixture	$1$	—	—

Appendix

Table 10: Targeted attacker (DS-V4) on SWE-bench Pro by task family, against the Pro generic-attacker baseline.

Figure 11: Create-path ASPR and callback rate versus the agent’s step budget (DS-V4, mini-SWE-agent, headline configuration, SWE-bench Verified). The locked

15

-step budget is shown in bold.

Model	$c^{\mathrm{seed}}$	$q$	$\phi$	$\hat{\rho}^{\mathrm{proxy}}$	$\hat{\rho}^{\mathrm{obs}}$	$ASPR_{5}/ASPR_{0}$	Observed cluster
Qwen3	$0.442$	$18.25$	$0.910$	$7.33$	$1.145$	$1.97$	worm
Gemma4	$0.317$	$18.50$	$0.758$	$4.44$	$1.035$	$1.19$	worm (mild)
Devstral	$0.517$	$16.68$	$0.760$	$6.55$	$0.983$	$0.92$	stable
GPT-OSS	$0.200$	$6.54$	$0.993$	$1.30$	$0.871$	$0.50$	slow-decay
MiniMax	$0.308$	$5.86$	$0.984$	$1.78$	$0.496$	$0.03$	collapse
DS-V4	$0.450$	$12.30$	$0.995$	$5.51$	$0.457$	$0.02$	collapse

Appendix

Table 11: Independent reproduction-number proxy

\hat{\rho}^{\mathrm{proxy}}=c^{\mathrm{seed}}\cdot q\cdot\phi

(computed under Assumption 1 via Definition 1 on the round-

0

agent-authored skills of the attacker-removed cascade) and the observed per-round growth

\hat{\rho}^{\mathrm{obs}}=(ASPR_{5}/ASPR_{0})^{1/5}

c^{\mathrm{seed}}

is measured from the cascade round-

0

run for consistency with

q

and

\phi

Figure 12: Predicted reproduction number

\hat{\rho}^{\mathrm{proxy}}=c\,q\,\phi

against observed per-round growth

\hat{\rho}^{\mathrm{obs}}

( Table 11 ). Open markers are the models the proxy misorders (DS-V4 and Devstral).

Figure 13: Seed vs. descendant copy rate for the four models with nonzero descendant retrieval (attacker-removed cascade, rounds

1

–

5

, with bootstrap

95\%

CIs as whiskers over

1000

resamples).

c^{\mathrm{seed}}

(open marker) is the round-

0

seed copy rate,

c^{\mathrm{desc}}

(filled) the descendant-turn rate, and the label is their ratio.

Setting	Value
Banner variant	module-init (comment $+$ decorator $+$ hook)
Payload	env-variable exfiltration
Planted skills	$8$ (a $3.4\%$ poisoning rate)
Benign pool	$232$ skills
Retrieval depth	top- $k\,{=}\,5$ , cosine, no threshold
Dataset	SWE-bench Verified, $N\,{=}\,153$

Appendix

Table 12: The locked headline configuration. Each ablation varies one setting and holds all others fixed.

(a) Banner vs. no-banner control
Model	A	B	$\Delta$ (pp)	$z$	$p$
Devstral	37.3	11.8	$+25.5$	$5.18$	$<\!0.001$
Gemma4	23.5	2.0	$+21.6$	$5.66$	$<\!0.001$
Qwen3	36.6	4.6	$+32.0$	$6.93$	$<\!0.001$
GPT-OSS	20.3	0.7	$+19.6$	$5.60$	$<\!0.001$
MiniMax	20.3	2.0	$+18.3$	$5.09$	$<\!0.001$

Appendix

Table 13: Significance of the headline lifts (two-sided two-proportion

z

-test). (a) RQ1 full banner vs. no-banner control (Verified,

N\,{=}\,153

). (b) RQ2 generic

\to

targeted: generic on

N\,{=}\,153

vs. the pooled targeted family set

N\,{=}\,85

(the Combined column of Table 3 ). A / B are the two compared rates (%).

	Pytest ( $N\,{=}\,15$ )			Config ( $N\,{=}\,38$ )			Regex ( $N\,{=}\,32$ )
Model	$\Delta$	$z$	$p$	$\Delta$	$z$	$p$	$\Delta$	$z$	$p$
Devstral	$+20.0$	$1.11$	$0.269$	$+31.6$	$2.90$	$0.004$	$+31.2$	$2.55$	$0.011$
Gemma4	$+40.0$	$2.24$	$0.025$	$+21.1$	$2.52$	$0.012$	$+25.0$	$2.42$	$0.016$
Qwen3	$+40.0$	$2.32$	$0.020$	$+31.6$	$2.75$	$0.006$	$+18.8$	$1.53$	$0.127$
GPT-OSS	$+40.0$	$2.48$	$0.013$	$+36.8$	$4.14$	$<\!0.001$	$+28.1$	$3.24$	$0.001$
MiniMax	$+33.3$	$1.89$	$0.058$	$+44.7$	$4.36$	$<\!0.001$	$+34.4$	$3.25$	$0.001$

Appendix

Table 14: Per-family targeted-attack vs. no-banner control lift (two-sided two-proportion

z

-test) on SWE-bench Verified: Pytest

N\,{=}\,15

, Config

N\,{=}\,38

, Regex

N\,{=}\,32

. Each cell reports

\Delta

(pp),

z

, and

p

for an Attack

-

Ctrl result in Table 3 .

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 330 papers

When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems
Aug 6, 2026Jialuo Chen, Lingqi Jiang, Xinhao Deng +7Adversarial Attacks AI Agent Security
Ant Group · Zhejiang University · Tsinghua University +3
Practice Makes Unsafe: Skill Misevolution in Self-Improving LLM Agents
Aug 13, 2026Xutao Mao, Liangjie Zhao, Xiang Zheng +1LLM Agent Skill Learning AI Agent Safety Benchmarks
City University of Hong Kong · Adelaide University
Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems
Apr 3, 2026Yubin Qu, Yi Liu, Tongcheng Geng +5AI Agent Security LLM Agent Security
Griffith University Australia · Quantstamp Singapore · The State Information Center China +4

Aug 6, 2026J/K move · Enter open · S save

When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems

Jialuo Chen, Lingqi Jiang, Xinhao Deng, Xiaohu Du+6

Ant Group · Zhejiang University · Tsinghua University+3

Adversarial Attacks AI Agent Security Agent Skill Learning Self-Evolving Agents

Open paper AskPDF arXiv

Self-evolving skill (SES) systems distill agent trajectories into persistent skills, allowing untrusted experience to become trusted instruction. We introduce PoisonedEvolution, a trajectory-poisoning attack on this promotion process. Our skill-visible black-box attacker can inspect a target skill and contribute bounded evidence, but cannot observe private pools or evolution logic or edit the skill bank. Artifact poisoning requires Inclusion, Evolution Attribution, and Realization. Attribution is the distinctive bottleneck: the target behavior must appear causally useful, recurrent, and generalizable before promotion. We evaluate four representative security-effect families using inert canary specifications. At 10% attacker support, across six mainstream LLM evolvers in SkillClaw, PoisonedEvolution embeds target behaviors in 546/600 trials (91.0% SER). On the structurally different Trace2Skill pipeline at the same ratio, it embeds target behaviors in 369/600 trials (61.5% SER), demonstrating transfer across evolution architectures. In a representative controlled study, three consistent attacker records suffice in a 30-record batch, whereas a single record is much weaker. Ablations identify recurring support, causal framing, and domain-aligned encoding as the main determinants of success. These findings expose evidence promotion as a security boundary for self-evolving agents.

Abstract

LLM Agent Security

Explore similar work

When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems

Practice Makes Unsafe: Skill Misevolution in Self-Improving LLM Agents

Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems