研究揭示了自进化的编码智能体中的自毒化问题，并提出了counter-prompt防御措施，有效降低了恶意技能的传播。对于关注AI安全和智能体研究的读者来说，这是一篇不容错过的论文。
自进化的LLM编码智能体通过模仿共享技能库中的技能来编写自己的工具。研究发现了这一循环中的漏洞：在创作过程中，检索到的恶意技能可以成为新技能的模板，保留恶意代码。我们称之为自毒化：智能体创作、存储和运行由此产生的恶意技能。通过EvoMal攻击，攻击者将可互换的有效载荷包装在横幅中，这是一种看起来无害的结构元素，诱导模仿智能体复制封装的代码。攻击者在库中植入恶意技能而不激活它们。然后，智能体创作并执行携带有害代码的新技能。每个创作的副本都可以重新进入库并被模仿，形成一个在移除植入的技能后仍能持续传播的蠕虫。在153个与工具相关的SWE-bench验证任务上的六个模型中，自毒化率（ASPR）从20.3%到41.8%不等，受毒化的库包含的恶意技能数量是植入的4.9到9.0倍。即使没有横幅，DeepSeek-V4-Pro的有效载荷也能达到11.1%的ASPR。将植入的技能描述定制到一种任务家族中，ASPR可提高到86.7%。移除植入的技能后，Qwen3在第五轮仍保持68%的ASPR，因为智能体创作的副本仍然存在。这些副本规避了现有的防御措施，这些措施主要关注攻击者提交的名称、代码和签名。我们提出了counter-prompt防御，它阻止横幅风格的复制，并将EvoMal的ASPR降低到最多6.7%，没有明显的任务完成损失。
EVOMAL: Self-Poisoning in Self-Evolving Coding Agents
Self-evolving LLM coding agents write their own tools by imitating retrieved skills from shared skill libraries. We identify a vulnerability in this loop: during authoring, a retrieved malicious skill can become the template for a new skill that preserves the payload. We call this self-poisoning: the agent authors, stores, and runs the resulting malicious skill. We exploit it through EvoMal, an attack that amplifies self-poisoning by wrapping an interchangeable payload in a banner, a set of benign-looking structural elements that induces an imitating agent to reproduce the enclosed code. The attacker plants malicious skills in the library without invoking them. The agent then authors and executes new skills carrying the harmful code. Each authored copy can re-enter the library and be imitated again, forming a self-propagating worm that persists after the planted skills are removed. We define the agent self-poisoning rate (ASPR) as the fraction of tasks that add a newly authored malicious skill to the library. Across six models on 153 tool-relevant SWE-bench Verified tasks, ASPR ranges from 20.3% to 41.8%, and the poisoned libraries hold 4.9 to 9.0 times as many malicious skills as were planted. The vulnerability also appears without a banner: DeepSeek-V4-Pro reaches 11.1% ASPR with the payload alone. Tailoring the planted skill descriptions to one task family raises ASPR to 86.7%. After the planted skills are removed, Qwen3 retains a round-5 ASPR of 68% because agent-authored copies remain. These copies evade existing defenses, which focus on attacker-submitted names, code, and signatures. We propose counter-prompt, a defense that discourages banner-style copying and reduces EvoMal's ASPR to at most 6.7% with no significant task-completion loss.