Practice Makes Unsafe: Skill Misevolution in Self-Improving LLM Agents

• URL: http://arxiv.org/abs/2608.12851v1
• Date: Thu, 13 Aug 2026 05:47:43 GMT
• Title: Practice Makes Unsafe: Skill Misevolution in Self-Improving LLM Agents
• Abstract summary: We introduce SkillMisevo-Gym, a lifecycle-aware harness that versions skill state across agent frameworks.<n>We also introduce SafeEvolve, a wrapper that repairs unsafe content and governs subsequent reuse.
• Score: 7.8654950055159345
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Self-improving LLM agents convert successful trajectories into persistent cross-task state. An unsafe success can thereby become reusable policy after its triggering input disappears. Skill evolution makes this failure measurable by distilling operational trajectories into executable, transferable, and inspectable procedures. Because evolution optimizes task outcomes rather than procedure safety, compromised experience can cause skill misevolution. Existing benchmarks measure current behavior or static artifacts but cannot attribute risk across authoring, retrieval, and later execution. To expose this lifecycle, we introduce SkillMisevo-Gym, a lifecycle-aware harness that versions skill state across agent frameworks, and SkillMisevo-Bench, a frozen design from malicious exposure to carryover tasks, with concept-aligned benign tasks and nine lifecycle metrics. We also introduce SafeEvolve, a wrapper that repairs unsafe content and governs subsequent reuse. Across 25 agent-method configurations, each covering 525 tasks in 25 episodes, all 21 evolved configurations author unsafe artifacts, while only fifteen lead to fresh-session harm. In the exposure sweep, three malicious tasks raise carryover ASR from 16.0% to 35.3%. Across representative skill evolution methods, SafeEvolve reduces unsafe retrieval and fresh-session harm by 26.7 and 17.3 percentage points, respectively, while mean benign utility changes by only 0.4 points. Together, persistent-adaptation safety must govern what updates write and what future executors reuse. Code is available at https://github.com/henrymao2004/misevolve.

Related papers

• SafeEvolve: Harness-Policy Co-Evolution from Agent Experience for Safety Alignment [51.263370090136696]
  We propose SafeEvolve, an experience-driven framework for agent safety alignment.<n>We leverage safety experience from completed on-policy trajectories to drive a continual loop of harness-policy co-evolution.<n>For Qwen3.5-4B, SafeEvolve achieves a $3times$ ASR reduction on AgentDojo while improving benign utility from 59.79% to 61.86%.
  arXiv  Detail & Related papers  (2026-09-02T16:19:54Z)
• Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents [30.77975669386977]
  We propose Defense-as-Skill, a defense paradigm that implements the runtime guard itself as an installable, inspectable, and editable skill.<n>Our guard, SkillSonar, checks sensitive actions against the user's task boundary, routing each action to an allow, replan, or confirmation decision.
  arXiv  Detail & Related papers  (2026-09-01T16:19:31Z)
• SHE: Trajectory-driven Safety Harness Evolution for LLM Agents [63.74895225415523]
  Existing safety mechanisms treat the harness as a fixed deployment artifact, limiting their ability to evolve with emerging risks.<n>We propose Safety Harness Evolution, a framework that learns evolving safe boundaries from rollout trajectories.<n>Experiments on Agent-SafetyBench demonstrate that SHE effectively enhances safety through harness evolution, achieving a 3.1x ASR reduction compared with static SafeHarness.
  arXiv  Detail & Related papers  (2026-08-10T17:35:08Z)
• When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems [9.77811063571131]
  Self-evolving skill (SES) systems distill agent trajectories into persistent skills, allowing untrusted experience to become trusted instruction.<n>We introduce PoisonedEvolution, a trajectory-poisoning attack on this promotion process.<n>Our skill-visible black-box attacker can inspect a target skill and contribute bounded evidence, but cannot observe private pools or evolution logic or edit the skill bank.
  arXiv  Detail & Related papers  (2026-08-06T03:32:43Z)
• SkillJack: Persistent Skill Backdoors in Self-Evolving Agents [5.713807329849712]
  We present textbfSkillJack, the first attack that exploits the experience-to-skill pipeline of self-evolving agents.<n>Instead of directly manipulating runtime context, SkillJack hijacks the agent's own learning process to implant malicious behaviors into its reusable skill repertoire.<n>Our findings reveal skill evolution as a new attack surface and motivate provenance-aware skill lifecycle protection.
  arXiv  Detail & Related papers  (2026-08-04T11:51:23Z)
• OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution [71.06848799741152]
  AI agents operate in persistent environments where early state changes can influence decisions far into the future.<n>Current safety benchmarks often fail to capture cumulative risks because they focus on short, static tasks.<n>We introduce OpenART, an open-ended arena for scalable agent red teaming through environment evolution.
  arXiv  Detail & Related papers  (2026-08-01T13:51:55Z)
• Self-Evolving Just-In-Time Memory for Proactive Embodied Safety [13.342067741014455]
  Existing safety approaches rely on runtime guardrails to block unsafe actions or induce excessive caution.<n>We introduce the Self-Evolving Just-In-Time Memory framework, which reframes embodied safety from progress-stalling guardrails to proactive hazard mitigation.
  arXiv  Detail & Related papers  (2026-06-26T14:26:24Z)
• SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction [89.03272793385054]
  Agent skills occupy a privileged position in the agent workflow, rendering third-party skills a vulnerable attack surface.<n>We introduce SkillHarm, a benchmark of skill-based attacks across the skill-use lifecycle.<n>We show that current agents remain vulnerable with attack success rates up to 86.3% in FPP and 69.3% in SMP.
  arXiv  Detail & Related papers  (2026-06-01T17:45:39Z)
• On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment [54.30690671490447]
  Existing safety-alignment signals are largely response-level or off-policy.<n>FATE transforms verifier-scored failures into repair supervision without expert demonstrations.<n>FATE reduces attack success rate by 33.5%, harmful compliance by 82.6%, and improves external trajectory-safety diagnosis by 6.5%.
  arXiv  Detail & Related papers  (2026-05-12T09:56:28Z)
• Learning Without Losing Identity: Capability Evolution for Embodied Agents [14.412476605788482]
  We propose a capability-centric evolution paradigm for embodied agents.<n>We argue that a robot should maintain a persistent agent as its cognitive identity.<n>We present a unified framework in which capability evolution is decoupled from agent identity.
  arXiv  Detail & Related papers  (2026-04-09T04:51:07Z)
• Your Agent May Misevolve: Emergent Risks in Self-evolving LLM Agents [58.69865074060139]
  We study the case where an agent's self-evolution deviates in unintended ways, leading to undesirable or even harmful outcomes.<n>Our empirical findings reveal that misevolution is a widespread risk, affecting agents built even on top-tier LLMs.<n>We discuss potential mitigation strategies to inspire further research on building safer and more trustworthy self-evolving agents.
  arXiv  Detail & Related papers  (2025-09-30T14:55:55Z)
• SafeAgentBench: A Benchmark for Safe Task Planning of Embodied LLM Agents [58.65256663334316]
  We present SafeAgentBench -- the first benchmark for safety-aware task planning of embodied LLM agents in interactive simulation environments.<n>SafeAgentBench includes: (1) an executable, diverse, and high-quality dataset of 750 tasks, rigorously curated to cover 10 potential hazards and 3 task types; (2) SafeAgentEnv, a universal embodied environment with a low-level controller, supporting multi-agent execution with 17 high-level actions for 9 state-of-the-art baselines; and (3) reliable evaluation methods from both execution and semantic perspectives.
  arXiv  Detail & Related papers  (2024-12-17T18:55:58Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.