Malicious AI agent skills shown to self-propagate through a shared library

An eight-author team including Ahmed E. Hassan and Bram Adams, both software-engineering researchers at Queen’s University, published a paper describing “self-poisoning” in coding agents that write and reuse “skills” — small packaged tools — copied from a shared library. The authors named the attack EvoMal: a single malicious skill, once planted in a library that agents draw on and contribute back to, does not simply sit there waiting to be reused. It can spread, because an agent authoring a new skill will often copy the structure of a retrieved one, malicious payload included, into work that looks unrelated to the original.

Testing across six language models and 153 coding tasks, the authors reported that a single planted malicious skill propagated into between 20.3% and 41.8% of a library’s subsequently authored entries, and that the compromised library ended up holding between 4.9 and 9.0 times as many malicious skills as were originally planted. The copies persisted even after the original malicious skill was deleted from the library, because the payload had already been reproduced inside newer, differently named skills that no longer resembled the source. The authors proposed a “counter-prompt” mitigation, which they reported cut the propagation rate to below 6.7% without reducing how often agents completed their assigned tasks.

The finding extends a run of August 2026 papers on the security of agent-skill ecosystems — including a gateway tool tested against the same class of attack and a cross-vendor standard for packaging skills that shipped weeks earlier — by arguing the underlying vulnerability is not just that a bad skill can be installed, but that it can reproduce itself through the ordinary, intended behaviour of a self-improving agent.