Shared Agent Skill Libraries Propagate Malware, 41.8% Self-Poisoning Rate Found

omarsar0 · x · 2026-08-27

New research reveals that shared skill libraries for coding agents, often treated as safe for reuse, can propagate malware. The EvoMal attack plants a malicious skill in a library; agents retrieve it as an authoring template, write new skills preserving the payload, and execute them. This "author-style copying" causes exponential spread of malicious skills.

Data: Across 6 models and 153 SWE-bench Verified tasks, agent self-poisoning rates range from 20.3% to 41.8%, with poisoned libraries holding 4.9 to 9.0 times more malicious skills than planted.
Cleanup Difficulty: Deleting planted skills fails to clean the library because agent-authored copies remain (e.g., Qwen3 shows 68% persistence at round five).
Mitigation: A counter-prompt discouraging banner-style copying drops the poisoning rate to 6.7% with no significant task-completion loss.

Original post →

Shared Agent Skill Libraries Propagate Malware, 41.8% Self-Poisoning Rate Found

More from coding & agent