Agent skill library malware propagation
A counter-prompt reduces poisoning to 6.7% without affecting task completion, offering developers a practical defense against this vulnerability.
EvoMal research reveals shared skill libraries can propagate malware through coding agents. The attack plants malicious skills that agents retrieve as templates, preserving payloads when creating new skills. Across six models on 153 SWE-bench Verified tasks, self-poisoning rates ranged from 20.3% to 41.8%. Poisoned libraries contained 4.9 to 9.0 times more malicious skills than originally planted. Even deleting planted skills left 68% contamination in Qwen3 after five rounds.
Important read if you build with agent skills. Shared skill libraries are treated as a safe way for coding agents to reuse each other's work. New research shows they propagate malware. EvoMal plants a malicious skill in the library and never invokes it. The agent retrieves it as an authoring template, writes a new skill that preserves the payload, stores it, and runs it. Each authored copy re-enters the library and gets imitated again. Across six models on 153 tool-relevant SWE-bench Verified tasks, the agent self-poisoning rate runs 20.3% to 41.8%. Poisoned libraries end up holding 4.9 to 9.0 times as many malicious skills as were planted. Deleting every planted skill does not clean it up. Qwen3 still shows 68% at round five because the agent-authored copies remain. A counter-prompt that discourages banner-style copying drops it to 6.7% with no significant task-completion loss. Paper: arxiv.org/abs/2608.25776 Chat with Paper: academy.dair.ai/papers/evomal-… 💬 1 🔄 1 ❤️ 13 👀 1906 📊 4 ⚡
