When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems

2026-08-05

AI Summary

This work identifies a critical security vulnerability in self-evolving agents: their susceptibility to malicious trajectory poisoning when distilling untrusted experiences into trusted instructions. To exploit this, the authors propose PoisonedEvolution, a black-box attack that requires only observation of a target skill and submission of limited evidence. By satisfying three key criteria—containment, evolutionary attribution, and realizability—the attack successfully induces the system to incorporate malicious behaviors into its skill repository. The study pioneers the characterization of security boundaries in the “evidence amplification” phase and introduces a novel trajectory-poisoning paradigm grounded in attribution bottlenecks, demonstrating cross-architecture transferability. Experiments show that with merely 10% attack support—equivalent to just three consistent malicious records—PoisonedEvolution achieves embedding success rates of 91.0% on SkillClaw and 61.5% on Trace2Skill.

Abstract

Self-evolving skill (SES) systems distill agent trajectories into persistent skills, allowing untrusted experience to become trusted instruction. We introduce PoisonedEvolution, a trajectory-poisoning attack on this promotion process. Our skill-visible black-box attacker can inspect a target skill and contribute bounded evidence, but cannot observe private pools or evolution logic or edit the skill bank. Artifact poisoning requires Inclusion, Evolution Attribution, and Realization. Attribution is the distinctive bottleneck: the target behavior must appear causally useful, recurrent, and generalizable before promotion. We evaluate four representative security-effect families using inert canary specifications. At 10% attacker support, across six mainstream LLM evolvers in SkillClaw, PoisonedEvolution embeds target behaviors in 546/600 trials (91.0% SER). On the structurally different Trace2Skill pipeline at the same ratio, it embeds target behaviors in 369/600 trials (61.5% SER), demonstrating transfer across evolution architectures. In a representative controlled study, three consistent attacker records suffice in a 30-record batch, whereas a single record is much weaker. Ablations identify recurring support, causal framing, and domain-aligned encoding as the main determinants of success. These findings expose evidence promotion as a security boundary for self-evolving agents.

Problem

• trajectory poisoning
• self-evolving agents
• skill distillation
• evidence promotion
• security boundary

Innovation

• trajectory poisoning
• self-evolving agents
• skill distillation
• attribution bottleneck
• evidence promotion