SkillJack Shows How Self-Evolving Agents Can Learn Persistent Backdoors

Introduction

Self-evolving agents are designed to improve over time. Rather than treating every task as a fresh start, they convert past interactions into reusable skills that can be invoked in future situations. The paper SkillJack: Persistent Skill Backdoors in Self-Evolving Agents argues that this learning mechanism creates a security risk that is more fundamental than traditional memory or retrieval poisoning.

In earlier attacks, malicious records usually matter only when they are retrieved into the agent’s runtime context. SkillJack changes the threat model. It targets the agent’s own experience-to-skill pipeline, turning a temporary poisoned interaction into a persistent behavioral artifact. Once the behavior is encoded as a skill, removing the original poisoned record may no longer remove the risk.

Key takeaways

• The attack moves from context to capability: SkillJack does not merely manipulate what the agent sees at runtime. It hijacks how the agent learns from experience and stores reusable behaviors.
• Skill extraction can hide malicious intent: The authors describe a phenomenon called “sanitization whitewashing.” During extraction, harmful intent may be abstracted, rewritten, or framed as a benign procedure, making the resulting skill appear safer than the trajectory that produced it.
• Transient experiences become long-term assets: Through “cross-layer promotion,” a one-off poisoned trajectory can be promoted into the skill layer, where it functions as a reusable capability rather than a piece of context.
• The backdoor can survive source removal: The paper calls this “persistence isolation.” Once a poisoned behavior has been encoded into the skill repository, deleting the original poisoned experience may not eliminate the implanted behavior.
• Detection becomes significantly harder: The study evaluates SkillJack on SkillX and Anything2Skill using 150 trajectories across four policy-risk categories. In SkillX, safety detection drops from 98.5% for poisoned trajectories to 11.4% for extracted skills. At the same time, the implanted skills remain effective, with reported attack success rates of 56.2% and 89.2% across the two systems.

Why it matters

The work highlights a shift in agent security. Defending only the runtime prompt, memory retrieval layer, or current context is not enough when agents can autonomously turn experience into persistent skills. The full lifecycle of a skill now matters: where the experience came from, how it was summarized, who approved it, when it was changed, and whether it can be rolled back.

This is especially relevant for long-running enterprise agents, coding agents, automation systems, and personal assistants that accumulate procedures over time. If a malicious or unsafe action is converted into a reusable skill, it may become part of the agent’s default operating repertoire. In that setting, simply cleaning a memory store may leave the more important artifact untouched.

SkillJack also suggests that safety evaluation should look beyond isolated prompts. A skill that appears harmless in its final form may still encode a harmful behavioral pattern inherited from its source trajectory. Future defenses will likely need provenance tracking, skill-level auditing, isolation mechanisms, and lifecycle governance for every learned capability.

Source: Hugging Face Daily Papers