EvoMal turns a shared agent skill library into a self-propagating worm, with 20.3-41.8% self-poisoning across six models
A paper submitted 2026-08-26 (arXiv 2608.25776) identifies self-poisoning in coding agents that author new skills by imitating retrieved ones. An attacker plants a malicious skill wrapped in a benign-looking structural banner and never invokes it; the agent imitates it, authors a new skill carrying the payload, stores it, and runs it. Across six models on 153 tool-relevant SWE-bench Verified tasks the agent self-poisoning rate ranges from 20.3% to 41.8%, poisoned libraries end up holding 4.9x to 9.0x as many malicious skills as were planted, and the propagation survives deleting the original planted skills. DeepSeek-V4-Pro still hits 11.1% with the raw payload and no banner. Anyone running a shared or community skill directory should read this before the next sync.
↳ Follow the thread