Poisoned Agent Skills Survive Memory Deletion: The SkillJack Attack

Defenses against agent memory poisoning assume the threat lives in retrieval: remove or filter the bad record, and the bad behavior goes with it. SkillJack breaks that assumption at the foundation. The attack doesn't need the poisoned record to survive. By the time a defender deletes it, the damage has already been compiled into something else entirely.

Self-evolving agents, systems like SkillX and Anything2Skill that convert interaction histories into reusable skill libraries, introduce a transformation step that existing threat models don't account for. A poisoned trajectory enters the experience-to-skill pipeline and exits as a named, callable capability. Three properties make this transformation dangerous. First, sanitization whitewashing: the skill extraction process strips narrative context and distills behavior into concise functional descriptions, which happens to also strip the signals that safety classifiers rely on. Second, cross-layer promotion: what was a transient, session-scoped memory becomes a persistent, session-independent artifact stored in the skill library. Third, persistence isolation: once the skill exists, the original poisoned record is no longer load-bearing. Delete it, and the skill remains.

The analogy is a compiled binary. A developer can delete the source code, but the executable still runs. SkillJack exploits the same structural gap: the artifact and its origin are decoupled the moment compilation completes.

SkillJack was evaluated across 150 trajectories spanning four policy-risk categories on both target systems. Safety detection on raw poisoned trajectories ran at 98.5% in SkillX. After skill extraction, that number collapsed to 11.4%. The attack didn't get smarter. The representation changed, and the classifier's signal disappeared. Attack success rates for implanted skills reached 56.2% on SkillX and 89.2% on Anything2Skill. Critically, 80.0% of skill-mediated attacks persisted after the original poisoned records were deleted, and some skills activated on entirely benign queries, extending the attack surface beyond the intended trigger conditions. For security teams and platform engineers shipping self-evolving agent infrastructure, the takeaway is direct: retrieval-layer defenses and trajectory-level safety filters do not protect the skill compilation stage, and any existing skill library built from unaudited interaction histories should be treated as potentially compromised.

We're thinking: We keep returning to the supply-chain framing here, because it's the most accurate one. The skill library in a self-evolving agent is structurally analogous to a package registry: it accumulates artifacts from upstream sources, those artifacts get called at runtime without re-examining their provenance, and the original source can be long gone by the time the artifact causes harm. What's striking about SkillJack is that it doesn't require a sophisticated attacker. The agent's own learning pipeline does the obfuscation work automatically, as a side effect of normal operation. No published mitigation addresses this yet. Teams shipping agents with persistent skill stores are running an unaudited artifact pipeline today, and the 80% persistence-after-deletion result means retrospective cleanup is not a reliable recovery path.

Key takeaways:

• Skill extraction in self-evolving agents decouples behavioral artifacts from their source records, creating a compilation step that existing safety classifiers were not designed to inspect.
• Safety detection drops from 98.5% to 11.4% after extraction on SkillX; attack success reaches 89.2% on Anything2Skill; 80% of attacks survive source deletion. Caveat: evaluation covers two systems and 150 trajectories, so generalization across other self-evolving architectures is still open.
• Teams deploying self-evolving agents with persistent skill libraries should audit existing skill stores for provenance, treat any skill compiled from unverified interaction histories as untrusted, and gate skill promotion behind a dedicated inspection layer rather than relying on upstream trajectory-level filters.

Source: SkillJack: Persistent Skill Backdoors in Self-Evolving Agents