AI 安全
EvoMal Enables Self-Evolving Coding Agents to Replicate Malicious Skills and Keep Spreading After the Original Source Is Removed
Researchers found that coding agents capable of writing and saving their own Skills may copy malicious structures retrieved from a shared repository into new tools. Self-poisoning rates across six models ranged from 20.3% to 41.8%, although the evidence so far comes mainly from benchmarks controlled by the authors.
A research team has introduced EvoMal, which tests another supply-chain attack path targeting “self-evolving” coding agents. An attacker does not need to ask an agent to execute a malicious Skill directly. Instead, the attacker only needs to place it in a searchable shared database. When the agent retrieves the Skill while solving a task, it may imitate its structure to write, save, and execute a new tool containing the same payload.
The attack uses a set of ordinary Python constructs disguised as required telemetry code, which the paper calls a banner. The functions, wrapper layers, and comments may each appear harmless, but together they increase the likelihood that the model will reproduce the code piece by piece. The newly generated malicious Skill is then written back to the index, where it can be retrieved for other tasks. As a result, the unit of propagation is no longer the original file submitted by the attacker, but a derivative file created by the agent itself and typically regarded as more trustworthy.
The authors tested six models on 153 tool-related SWE-bench Verified tasks, measuring ASPR, the “proportion of tasks that add a malicious Skill.” Standard attacks achieved rates ranging from 20.3% to 41.8%, while the poisoned database ultimately contained 4.9 to 9 times as many malicious entries as were originally planted. When Skill descriptions were tailored only to task families such as pytest, the highest ASPR rose to 86.7%. Even after the attacker-planted entries were removed, Qwen3 still recorded a 68% ASPR in the fifth round because previously generated copies continued to be retrieved.
The researchers also ported the same mechanism to OpenHands and Claude Code scaffolding; both exhibited replication behavior in configurations targeting specific task families. This does not, however, mean that off-the-shelf products have the same infection rates under default deployments. The experiments used a Skill repository, retrieval rules, task distribution, and executable payload designed by the authors. Real-world risk will depend on sandboxing, permissions, network access, and write-back policies.
The authors’ four-line counter-prompt reduced ASPR to below 1.8% in the main configurations, with a worst-case result of 6.7%, but it remains a soft control that can be affected by model behavior. A more structured approach would isolate agent-generated content and use signatures and administrator approval records to determine which Skills may re-enter the retrieval pool. Engineering teams should therefore examine not only where Skills are installed from, but also whether controls for automatic write-back, derivative-file provenance, index cleanup, and pre-execution policy enforcement cover code written by the agents themselves.