Your Agent Wrote Its Own Skills. Now the Compromise Never Leaves.

Anthropic's own evaluation rated Claude Code Auto Mode at 0.00 percent prompt injection success. A researcher just got 60 to 80 percent code execution against it with a shadowed Python file. The attack did not trick the model. It tricked the model's habits.

That is the warm-up act. The real story this week is what happens when agents stop taking skills from you and start writing their own. New research shows a single injected skill can propagate through a self-evolving agent's library and persist across sessions. PhantomByte covered skill libraries rotting at 100 entries in Note #168. Rotting is the good outcome. The bad outcome is infection.

Here is the thesis, stated bluntly: once your agent generates its own capabilities, a compromise is no longer a session event you can clear. It is a persistent state you have to design against. That threat model applies specifically to agents capable of runtime tool generation, self-evolution, or persistent skill storage. Simple stateless LLM wrappers and rigid hard-coded toolchains are not exposed to the skill-library infection vector described here.

The attack that rated zero

Johann Rehberger, the researcher who broke Auto Mode, did not find a clever prompt. He built a supply-chain trojan. A malicious page convinces Claude to reach for curl instead of WebFetch. The server returns a redirect to a ZIP archive. Inside that archive sits a file named struct.py, which shadows Python's own standard library. When Claude runs its own decoder inside the attacker-controlled directory, Python loads the malicious struct.py first. Execution is hijacked. The model never intended to run malware. It just followed its own predictable tool-use habits.

The key line from the data is worth sitting with: everyone gets the same model, so learning its tool-use tics is a repeatable attack, not a one-off. Rehberger hit 60 to 80 percent success against a setting rated 0.00 percent safe. That gap is not a bug in one model. It is a property of the whole approach.

Attackers already treat your agent stack as a product with documentation. Consider Aurora, the ransomware crew that ran Cursor and Claude Sonnet against more than 20 organizations across nine countries between April and July 2026. The majority of their commands failed on the first attempt. They refined them until they worked. They even restricted the agent from DCSync, account lockouts, and domain object creation, which is a threat actor doing capability confinement better than most defenders. They learned the agent's habits, and they shipped.

Why self-evolving changes the math

The Rehberger attack is bad. The EvoSkill Injection research is worse, because it changes what a compromise means.

EvoSkill Injection, accepted to EMNLP 2026, red-teams agents that generate, refine, and reuse their own skills. The finding is direct: a single injected malicious skill propagates through the agent's library, and the agent's own evolution process amplifies the compromise. The skill is persistently stored and repeatedly activated across sessions. You do not clear it by ending the session. It survives.

Contrast that with a traditional compromise. A hacked prompt is transient. You close the session, you clear the context, and it is gone. A hacked skill is infrastructure. It sits in the library, it gets retrieved, it gets reused, and every time the agent evolves, it can spread further. This is the article's citable concept: compromise as state, not event.

The skill supply chain

The industry is converging on the same conclusion from two directions at once.

On the research side, a new arXiv paper, Towards a Systems Foundation for Agentic Skills, argues that skills are a new class of software artifact with their own lifecycle, versioning, and supply-chain risk. Skills are not code and they are not prompts. They are a third thing, and they need their own engineering discipline. The paper lays out a nine-stage lifecycle from discovery to security governance, and it names adversarial threat vectors as a first-class concern.

On the commercial side, AIR just raised $50 million from Sequoia and Greenoaks to vet the skills and add-ons that AI agents use. The company treats agent skills as a supply chain that must be audited the way software dependencies are audited. That is not a niche bet. It is venture capital validating the exact problem this article is about.

The reason is simple. A malicious skill grants capabilities the agent was never supposed to have. You cannot rely on the model to resist injection. You have to constrain what the agent can reach. That is the reachability-based confinement argument from this week's research: compute the set of actions the agent could reach, and confine it, instead of hoping the model says no.

The three-gate skill quarantine

Here is a framework you can implement this week. Call it the Three-Gate Skill Quarantine.

Gate 1, provenance. No skill enters the library without a signed source, a hash, and a human or automated review of what it can touch. If you cannot name where a skill came from, it does not get in. Period.

Gate 2, sandbox. New and self-generated skills run with restricted tool access for a probation period. Capabilities expand only after observed behavior. Do not rely on the model resisting injection. Constrain the set of actions the agent could reach, and fail closed.

Gate 3, the amnesia test. Kill the skill, restart the agent, and check whether the capability persists where it should not. Persistence across sessions is the signature of skill-library infection. If the skill comes back, you are not looking at a bug. You are looking at a compromise. The amnesia test is a clean conceptual metric, but programmatically detecting stealthy state modifications across complex agent persistent layers can be challenging in production environments.

What to do today

Inventory every skill and plugin your agents can invoke, including the ones they generated themselves. Most teams cannot name half of what is in their agent libraries right now.

Add a provenance gate. No unsigned skills in the library, period.

Quarantine self-generated skills behind restricted tool access before granting reach.

Run an amnesia test this week. Delete a skill, restart, verify it is actually gone.

Read the EvoSkill Injection paper before you ship any self-evolving feature. It is short, and it will change how you think about your agent's library.

The uncomfortable question

Your agent is learning. Who is teaching it?

If you cannot name the provenance of every skill in your agent's library, you are not running software. You are hosting a colony. And a colony that writes its own skills is a colony that can hide its own infection.

The compromise is not an event anymore. It is a state. Design for that, or find out the hard way.