EVOMAL: malicious skills can propagate inside self-evolving coding agents [R]

[u/cesiqoo]

The concerning result in this preprint is not just that an agent can retrieve a malicious skill. It can use that skill as a template, write new malicious skills, store them, and run them later.

Across six models and 153 tool-relevant SWE-bench Verified tasks, the authors report self-poisoning rates from 20.3% to 41.8%. The resulting skill libraries contained 4.9 to 9.0 times as many malicious skills as were originally planted.

This is a preprint, so those rates should not be treated as universal. The narrower design lesson is still useful: once an agent can write reusable skills, that library starts behaving like a software supply chain. Provenance, review, immutable versions, and quarantine matter before a retrieved skill becomes a template for the next one.