Researchers detail SkillJack backdoor attack on agents
The attack targets self-evolving agents that turn past interactions into reusable skills.
Why it matters
The work points to a security risk in agent systems that learn or distill durable capabilities from prior interactions. It suggests defenses focused only on memory retrieval or context filtering may miss backdoors that survive as extracted skills.
The key points
- 1.SkillJack targets the experience-to-skill pipeline in self-evolving agents.
- 2.The attack can persist after original poisoned records are removed.
- 3.Evaluation covered SkillX, Anything2Skill, and 150 trajectories.
A paper on Hugging Face describes SkillJack, an attack against self-evolving agents that convert interaction histories into persistent reusable skills. The authors say the attack manipulates the experience-to-skill pipeline so malicious behavior can be embedded in an agent's skill repertoire, rather than only appearing when poisoned memory is retrieved. They evaluated the attack on SkillX and Anything2Skill using 150 trajectories across four policy-risk categories.
⚡ Try this today
Audit any agent workflow that turns interactions into reusable skills, including checks after source records are removed.
Sources & original reporting
This brief summarizes and links to reporting from the publishers below.
Enjoyed this brief? Get the next one in your inbox.
More in Research
HarnessRisk benchmark tests agent harness safety
The benchmark evaluates safety failures across agent harness lifecycle phases.
Agent Lightning v1.0 targets harnessed agentic RL
The lightweight framework connects arbitrary agent harnesses to RL training through an LLM proxy.
Paper tests cross-model transfer for hashed LLM memory
The study finds frozen external memory needs a target-aligned reader to work across backbones.