'Practice Makes Unsafe': every one of 21 self-evolving agent configurations wrote unsafe skills that outlived the attack that caused them

arXiv·high signalXBlueskyLinkedInCopy link

arXiv 2608.12851 (2026-08-13) names a failure mode the authors call skill misevolution: an agent that learns from its own successful trajectories turns an unsafe success into reusable policy, and the skill persists after the malicious triggering input is gone. Across 25 agent-method configurations covering 525 tasks in 25 episodes, all 21 evolved configurations authored unsafe artifacts and 15 caused harm in a fresh session with no attacker present; malicious exposure lifted carryover attack success from 16.0% to 35.3%. Their SafeEvolve wrapper repairs unsafe content and governs reuse, cutting unsafe retrieval 26.7 points and fresh-session harm 17.3 points for a 0.4-point utility cost — the practical lesson is that a skill library is persistent attack surface and needs its own admission control.