EvoMal turns a shared skill library into a self-propagating worm, at 20.3 to 41.8% self-poisoning across six models.

A paper submitted August 26 identifies self-poisoning in coding agents that author new skills by imitating retrieved ones. An attacker plants a malicious skill wrapped in a benign-looking structural banner and never invokes it; the agent imitates it, authors a new skill carrying the payload, stores it, and runs it. Across six models on 153 tool-relevant SWE-bench Verified tasks, poisoned libraries end up holding 4.9x to 9.0x as many malicious skills as were planted, and propagation survives deleting the originals (arXiv 2608.25776). DeepSeek-V4-Pro still self-poisons at 11.1% with the raw payload and no banner. Read this before your next community skill directory sync.