EVOMAL: Self-Poisoning in Self-Evolving Coding Agents

TL;DR - EVOMAL exposes a self-poisoning vulnerability in self-evolving coding agents: malicious skills can be imitated, stored, executed, and propagated through shared skill libraries. The attack persists after the original planted skills are removed, while a counter-prompt reduces the measured attack rate substantially without significant task-completion loss.

• Across six models and 153 SWE-bench Verified tasks, agent self-poisoning rates ranged from 20.3% to 41.8%, expanding malicious skills by 4.9–9.0×.
• Task-specific malicious skill descriptions raised the self-poisoning rate to 86.7%; payload-only attacks also worked, reaching 11.1% on DeepSeek-V4-Pro.
• Agent-authored copies formed a persistent propagation loop; Qwen3 still showed a 68% self-poisoning rate in round five after planted skills were removed.
• A counter-prompt discouraging banner-style copying reduced the attack rate to at most 6.7% with no significant task-completion loss.