A new research paper from Hugging Face introduces SkillJack, the first attack that exploits the skill-creation process of self-evolving AI agents. Unlike prior memory poisoning attacks, which only work when poisoned records are retrieved as context, SkillJack hijacks the agent's own learning pipeline to convert transient malicious experiences into persistent, reusable skills.
The attack leverages three key properties of the experience-to-skill transformation: sanitization whitewashing, where malicious intent is obscured during skill extraction; cross-layer promotion, where temporary experiences become durable capabilities; and persistence isolation, where the attack survives deletion of its original source records.
In evaluations on two representative systems, SkillX and Anything2Skill, using 150 trajectories across four policy-risk categories, the researchers found that skill extraction dramatically reduces detectability. Safety detection for poisoned trajectories dropped from 98.5% to 11.4% for extracted skills in SkillX, with a similar effect in Anything2Skill. Meanwhile, the implanted skills remained effective, achieving attack success rates of 56.2% and 89.2% on the two systems, respectively.
Notably, 80.0% of skill-mediated attacks persisted after deleting the original poisoned records, and some skills unintentionally activated on benign queries. The findings reveal skill evolution as a new attack surface and motivate provenance-aware skill lifecycle protection. The code is available on GitHub.