A paper submitted to arXiv on 26 August, "EVOMAL: Self-Poisoning in Self-Evolving Coding Agents," describes a failure mode specific to agents that improve by writing skills into a shared library and retrieving them later. It is the most consequential agent-security result of the week, and the number that will be quoted from it is the wrong one.
The mechanism
Self-evolving agents retrieve an existing skill, imitate its structure to write a new one, and store the result for future retrieval. The paper shows that when a retrieved skill contains a harmful payload wrapped in benign-looking structural code — which the authors call a banner — the imitating agent reproduces the structure along with the payload, then saves and executes its own copy. The attacker plants a skill and never triggers it. The agents do the propagation, and each copy becomes a source for the next. Planted skills multiply by 4.9 to 9.0 times in a poisoned library.
What the common framing gets wrong
The abstract contains 86.7%, and that is the figure headlines will carry. It is measured under the paper's most favourable condition: when the planted skills are tailored to specific task families. The general result — six models, 153 tasks — is a self-poisoning rate of 20.3% to 41.8%. Strip out the structural banner and the rate falls to 11.1% on DeepSeek-V4-Pro. So the honest summary is that roughly one in three to one in five agent runs self-poison under realistic conditions, which is alarming enough without the tailored number, and that the banner technique is what does most of the work. Quoting 86.7% as the rate misrepresents an attack that requires per-task-family preparation as one that works generically.
The finding that should worry operators
Persistence is the real result. After the originally planted skills are removed from the library, self-poisoning continues at 68% by round five on Qwen3. The agents' own copies have become the infection source. That breaks the standard incident response for a poisoned artifact store — identify the bad entries, delete them, move on. Here deletion of the seeds leaves a library that reinfects, and there is no obvious way to distinguish a derived malicious skill from a legitimate one written in the same house style.
The defence, and its limits
The authors propose a counter-prompt that reduces the self-poisoning rate to at most 6.7%. That is a large reduction and it is not elimination. A 6.7% residual against a mechanism that compounds across rounds and multiplies copies 4.9 to 9.0 times is a slower fire, not an extinguished one. The structural conclusion — that a shared, writable, self-retrieving skill library is an attack surface that grows with use — is not addressed by prompting, and shared skill libraries are precisely the direction agent platforms are being built.