Self-evolving agents will store and repeatedly re-fire a malicious skill they wrote themselves.

Skill-based architectures let agents generate, refine and reuse procedures from past runs, which means a malicious capability can be written into the skill store as a legitimate artifact (arXiv 2608.30429). SARGE red-teams that pipeline through iterative generation, escalation and reinforcement, with EvoSkillBench inducing malicious skill formation and EvoSkillSafetyBench testing later retrieval. The finding is persistence: injected skills survive in storage and activate repeatedly, so one successful interaction becomes durable capability corruption.