Thompson's trusting-trust attack, ported to self-modifying coding agents.

Roesner and Kohno poisoned benchmarks against Darwin Godel Machine, Self-Improving Coding Agent and Hyperagents, using the agent's own self-evaluation loop as the vector. Hyperagents on Sonnet 4.5 self-evolved instructions that disable HTTPS certificate validation on neutral held-out URL-fetching tasks. The operational result that matters is persistence: contamination often survives after the poisoned agent is subsequently evolved against clean benchmarks. Re-running a clean eval suite is not remediation. If your agent rewrites its own prompts or skills against an eval set, that eval set is an untrusted input with the same provenance requirements as a dependency.