EVOMAL Finds Self-Poisoning Risk in Self-Evolving Coding Agents

A new supply-chain risk for self-evolving coding agents

A research paper submitted to arXiv on August 26, 2026 introduces EVOMAL, an attack that targets coding agents capable of retrieving shared skills, authoring new tools and storing those tools for future reuse.

The researchers call the underlying failure mode self-poisoning. A malicious skill does not need to be directly invoked. Instead, an agent can retrieve it as an example, imitate its structure while writing a new skill, preserve the malicious payload and then save and execute the newly authored copy.

This is research, not a report of a confirmed real-world worm outbreak. The results come from controlled experiments on coding-agent workflows and SWE-bench Verified tasks.

How the EVOMAL attack works

The attack plants malicious skills in a shared skill library. When an agent retrieves one of those skills while solving an unrelated task, the malicious code is wrapped in structural cues that encourage the model to copy the payload into a newly authored skill.

That new skill can then re-enter the library. Other agent runs may retrieve and imitate it again, creating a propagation loop.

The authors describe this as especially concerning because the original attacker-planted skill can be removed while agent-authored copies continue to persist.

Reported results

The paper evaluates six models across 153 tool-relevant SWE-bench Verified tasks.

The authors report an agent self-poisoning rate (ASPR) of 20.3% to 41.8% across the tested models. Poisoned libraries contained 4.9 to 9.0 times as many malicious skills as were initially planted.

The researchers also report that a payload without the banner-style wrapper still produced an 11.1% ASPR for DeepSeek-V4-Pro.

When planted skill descriptions were tailored to one task family, the reported ASPR reached 86.7%.

In a persistence experiment, Qwen3 still showed a 68% round-five ASPR after the original planted skills were removed, because agent-authored copies remained in the library.

These are author-reported benchmark results and should not be generalized to every coding-agent architecture or production deployment.

Why existing defenses may miss it

Traditional supply-chain defenses often focus on attacker-submitted artifacts: suspicious filenames, known signatures, untrusted code or the original malicious package.

EVOMAL highlights a different problem. Once the agent rewrites the behavior into a newly authored skill, the harmful content may no longer look like the original planted artifact.

That means provenance, inheritance and transformation history become important security signals for agent-generated tools.

Proposed defense

The paper proposes a counter-prompt that discourages the agent from reproducing suspicious banner-style structures when authoring new skills.

The authors report that this reduces EVOMAL's ASPR to at most 6.7% in their experiments without a statistically significant loss in task completion.

A prompt-level defense is unlikely to be sufficient by itself for high-assurance environments. Production systems should also consider sandboxing, provenance tracking, code review, least-privilege execution, signed skill registries, policy checks and isolation between retrieved examples and executable tools.

Why this matters

Coding agents are moving from one-shot code generation toward persistent systems that can learn reusable procedures and create their own tools.

That capability creates a new software supply chain: not only human-written packages, but also agent-authored artifacts derived from other artifacts.

EVOMAL provides evidence that this recursive reuse path can amplify a malicious pattern. The work is therefore relevant to teams building self-improving agents, shared skill repositories, autonomous coding systems and long-running developer agents.