Tencent: poisoned agent experience becomes a permanent skill

Self-evolving agents can turn a single poisoned experience into a skill they keep forever, per Tencent's SkillJack paper on arXiv.

That's what matters for anyone letting an agent write and reuse its own skills. Standard poisoned-data detection works 98.5% of the time on raw experience, but only 11.4% once that behavior is baked into a skill file.

The attack worked 56.2% of the time against the SkillX extraction system and 89.2% against Anything2Skill, per the paper's benchmarks.

Researchers deleted the original poisoned experience after an agent had already extracted a skill from it. 80% of those implanted skills survived anyway.

Most anti-poisoning defenses check inputs: prompts, training experience, tool outputs. SkillJack targets what an agent produces afterward, a skill file that becomes its own artifact with its own lifecycle. Tencent posted proof-of-concept code for the attack on GitHub, at github.com/Tencent/AI-Infra-Guard. That leaves provenance tracking on the skill itself, not just the experience that produced it, as the gap worth closing.