EvoBreak jailbreaks self-evolving agents without a malicious memory

EvoBreak jailbreaks a self-evolving AI agent without writing a single malicious memory, per a paper posted to arXiv (2608.01759). Self-evolving agents update their own memory from what they learn on the job, and EvoBreak turns that update process against them.

That breaks the core assumption behind agent memory safety tools, that scanning each record alone is enough. A filter that checks writes one at a time never sees a jailbreak built from several benign records.

The attack watches what the victim distills from its own experience, then finds the gaps in target-relevant knowledge it hasn't picked up yet.

EvoBreak closes those gaps through ordinary-looking tasks engineered to leave behind exactly the missing pieces. Nothing about any single task reads as malicious. Only the final query, built to activate the accumulated pieces together, does the damage, per the paper.

The attacker never needs direct access to the agent's memory, per the paper. Ordinary-looking tasks are enough to shape what the agent stores on its own.