Poisoned skills survive deleting the poisoned records: 80% persistence, and safety detection collapses from 98.5% to 11.4% once a trajectory becomes a skill

arXiv 2608.03509·medium signalXBlueskyLinkedInCopy link

SkillJack shows the distillation step itself launders intent — safety detection on poisoned trajectories in SkillX ran 98.5%, but on the skills extracted from those same trajectories it fell to 11.4%. Attack success hit 56.2% on SkillX and 89.2% on Anything2Skill across 150 trajectories in four policy-risk categories, and 80.0% of skill-mediated attacks persisted after the original poisoned records were deleted. The operational lesson: purging your trace store is not remediation — you have to re-scan the derived skill bank, and scan it as skills, not as traces.