Individually benign agent experiences compose into a jailbreak: EvoBreak attacks self-evolving agents without ever writing a malicious memory
Self-evolving agents distill interaction trajectories into persistent experiences, and this work shows that experiences which are harmless in isolation can jointly weaken the agent's safety boundary once accumulated and reused across sessions. Unlike prior memory attacks, EvoBreak needs no direct memory access and plants no explicitly malicious record: it repeatedly observes what the victim distills, identifies uncovered target-relevant requirements, adaptively acquires complementary experiences through benign-looking tasks, then reformulates a final query that activates them together. It is trained with rejection-sampling SFT and Hint-guided GRPO against BreakGym, a synthesis pipeline that generates decomposable safety-sensitive targets, and consistently outperforms existing attacks across frameworks, backbones and safety benchmarks while staying benign per-record — meaning per-write memory filters are structurally the wrong control here.
↳ Follow the thread