Self-evolving coding agents are designed to improve by turning past work into reusable skills. New research suggests that the same mechanism can also turn a planted malicious example into a persistent supply chain for bad code. The warning is not simply that an agent may retrieve poisoned material. It is that the agent can imitate that material, save a fresh copy under its own name, and later execute the copy on another task.
The finding comes from EvoMal, a study submitted to arXiv on August 26 by researchers from several universities, including Queen’s University and Zhejiang University. The authors tested six language models on 153 tool-relevant tasks drawn from SWE-bench Verified. Their attack placed malicious skills in a shared library but did not invoke them directly. Instead, the agent encountered one while researching a task and used its structure when writing a new helper.
How a retrieved skill becomes a new infection
EvoMal measures what the researchers call the agent self-poisoning rate: the share of tasks in which the agent adds a newly authored malicious skill to the library. Across the six tested models, that rate ranged from 20.3% to 41.8%. The resulting libraries held between 4.9 and 9 times as many malicious skills as the attacker initially planted.
The attack used a banner of apparently benign structure around an interchangeable payload. Removing that banner reduced the effect but did not eliminate it: DeepSeek-V4-Pro still produced an 11.1% self-poisoning rate with the payload alone. Descriptions tuned to a task family pushed one result to 86.7%. In a five-round test, Qwen3 still recorded a 68% rate after the planted skills had been withdrawn because agent-authored copies remained available for imitation.
The experiments were controlled, not a report of compromised production systems. The paper says payloads ran inside a network-isolated sandbox, used fake credentials, and contacted only a local test endpoint. Its numbers therefore demonstrate a mechanism under specified benchmark conditions; they do not establish the prevalence of this attack in deployed coding products.
TENS analysis: the security boundary moves
The first original contribution from TENS Magazine is a lifecycle reading of the attack. A conventional scanner asks whether an artifact entering a library is malicious. EvoMal shows why that question becomes incomplete when agents can author successors: the object that crosses the final trust boundary may be a new file created after admission, under a name and structure chosen by the agent. Security therefore has to follow provenance from retrieval through creation, storage, selection, and execution.
A separate August study called SkillJack strengthens that interpretation from another direction. Its researchers examined systems that compile experience records into reusable skills. In one system, safety detection fell from 98.5% on poisoned trajectories to 11.4% on extracted skills. The derived skills produced attack success rates of 56.2% and 89.2% across two implementations, while 80% of tested attacks persisted after the original records were deleted.
The second original contribution is a comparison of two different persistence paths. SkillJack starts with poisoned experience that is transformed into a durable skill; EvoMal starts with a planted skill that is imitated into additional skills. Together they identify the same governance gap: deletion at the source layer is not equivalent to revocation at every derived layer. A trustworthy agent needs a dependency map capable of finding descendants, not only a delete button for the original item.
That conclusion also fits a recent survey of self-evolving coding agents. The survey organizes systems by what changes—frameworks, memory, skills, models, workflows, or environments—and argues that evaluation must extend beyond one-shot task completion to maintainability, reversibility, safety, cost, and generalization. A skill that helps pass today’s test can still degrade tomorrow’s system if its origin, scope, and downstream copies are unknown.
A defense needs both policy and structure
EvoMal proposes a counter-prompt telling models not to reproduce banner-style boilerplate. In its tests, the defense reduced the attack’s self-poisoning rate to no more than 6.7% without a statistically significant loss in task completion. The authors also describe a stronger structural control: agent-authored skills enter quarantine and cannot become retrievable until a curator signs them.
The third original contribution is a practical three-gate deployment test. Before a learned skill can influence future work, operators should require traceable ancestry, independent validation in a restricted environment, and explicit promotion into the retrievable library. If any descendant cannot be located and revoked, the system is not genuinely reversible. If validation and promotion are performed by the same self-modifying loop, the control is not independent.
This does not make self-evolution a dead end. Reusable skills could reduce repeated work and allow agents to adapt without retraining a base model. But persistence converts yesterday’s context into tomorrow’s executable infrastructure. The more an agent can learn from itself, the more its memory must be governed like a software supply chain rather than treated as a convenient archive.
Featured image: Networking check for the new GX cluster in NASA’s Advanced Computational Concepts Laboratory. Photo: NASA via Wikimedia Commons. Public domain, NASA and United States government work. Cropped from 3,600 × 2,880 pixels to 3,200 × 1,800 pixels and resized to 2,400 × 1,350 pixels; no generative or substantive alteration. The photograph is illustrative and does not depict the research described.
