Trajectory Poisoning in Self-Evolving Agent Skills

Description

Self-evolving agent-skill systems may promote recurring, attacker-controlled execution records into persistent reusable instructions. The paper evaluates whether poisoned but task-plausible trajectories survive aggregation and appear in generated skill artifacts, using inert canary behaviors and two structurally different skill-evolution pipelines.

Examples

Use inert canary records, synthetic destinations, temporary test paths, isolated generated-skill diffs, and no operational side effects when evaluating trajectory admission; see https://arxiv.org/html/2608.05563 (opens in a new tab).

Impact

With three attacker-controlled records in 30-record batches, the target behavior appears in 546 of 600 completed SkillClaw evolution trials (91.0%) and 369 of 600 Trace2Skill trials (61.5%). These are artifact-level measurements only: the experiments do not execute the generated behavior, establish endpoint compromise, or prove production exploitability. Optional SkillClaw quality modules were disabled in the main matrix.

Affected Systems

• SkillClaw and Trace2Skill self-evolving agent-skill pipelines
• Shared trajectory pools, execution-log ingestion, skill distillation, and reusable-skill update workflows
• Persistent agent-skill stores that promote untrusted cross-task experiences into future instructions

Mitigation Steps

• Authenticate trajectory contributors and preserve provenance, task ownership, and trust level throughout aggregation.
• Prevent untrusted execution logs from becoming privileged reusable instructions without explicit human review.
• Cluster repeated submissions by origin and detect coordinated or duplicated support before distilling a new skill.
• Compare generated skill updates against prior approved behavior and flag newly introduced sensitive capabilities.
• Use sandboxed canary-only evaluation and verify that review, provenance, and publish-time quality gates remain enabled.

Evidence

• https://arxiv.org/html/2608.05563 (opens in a new tab) — Experimental setup evaluates six named skill-evolver models with three poisoned records in 30-record batches.
• https://arxiv.org/html/2608.05563 (opens in a new tab) — Table 1 reports 546/600 completed SkillClaw trials containing the targeted behavior and lists the six directly evaluated evolver models.
• https://arxiv.org/html/2608.05563 (opens in a new tab) — Structural-transfer results report 369/600 affected Trace2Skill evolution trials.
• https://arxiv.org/html/2608.05563 (opens in a new tab) — Experimental setup states that generated effects were represented by inert canaries, no endpoint request or tool effect was executed, and optional SkillClaw quality modules were disabled.