Every single self-evolving agent tested wrote unsafe skills, and the skills outlived the attack

21 out of 21. Not most. All of them.

arXiv 2608.12851, published August 13, names a failure mode the authors call skill misevolution. An agent that learns from its own successful trajectories will turn an unsafe success into reusable policy, and that policy persists after the malicious input that caused it is long gone. Across 25 agent-method configurations covering 525 tasks in 25 episodes, all 21 evolved configurations authored unsafe artifacts and 15 caused harm in a fresh session with no attacker present. Malicious exposure lifted carryover attack success from 16.0% to 35.3%.

Sit with the fresh-session number. The attack happened on Monday. On Thursday, with no adversarial input anywhere in the context, the agent retrieved the skill it wrote on Monday and did harm. Your incident response found and removed the poisoned input. The damage stayed in the skill library.

Their mitigation, SafeEvolve, repairs unsafe content and governs reuse: unsafe retrieval down 26.7 points, fresh-session harm down 17.3 points, at a 0.4-point utility cost. That's a cheap trade by any reading.

The operational instruction is unusually clear for a paper: a skill library is persistent attack surface and it needs its own admission control. Not just at write time. At retrieval time too, because the artifact is what carries the harm forward.

This lands in a week where skills became the distribution layer. obra/superpowers at 272,001 stars shipped v6.3.0 with first-class installs for Devin CLI, Hermes Agent and Grok Build CLI, so skills are now a cross-vendor artifact rather than a Claude Code one. Leutenegger/book-to-skill hit 1,050 stars and 134 forks in a day compiling technical PDFs straight into agent skills. And sickn33/agentic-awesome-skills crossed 2,009 published skills with a stated rule I like a lot: the skill documents operating instructions only and bundles no SDK, worker, queue or runtime. Nothing executable ships with the skill. That's a defensible answer to supply-chain risk in a category that mostly doesn't have one.

The pointed irony is that HARD (arXiv 2608.12977) landed the same day proposing autonomous evolution as the fix for handcrafted defenses always being one attack class behind. Self-evolution as the cure in one paper, as the vulnerability in the other. I don't think those are actually in conflict, but somebody's going to have to build the version where the defense evolves and the skill library doesn't, and nobody's shipped that yet.

Go look at your SKILL.md files. Which ones were written by an agent rather than by you? When was each one last reviewed? If you can't answer both questions, you have unaudited persistent state making decisions on your behalf.