Tencent lab plants persistent backdoors in agent skill libraries

A new paper from Tencent's Zhuque Lab, published on Hugging Face, points at a specific weak spot in the current wave of self-evolving agents: the moment an agent turns yesterday's interaction history into a reusable skill it can apply tomorrow.

The claim is that if you poison the experience feeding that pipeline, the agent's own extraction step launders the malicious behavior into a benign-looking skill. In their test bed on SkillX, an LLM judge flagged 98.5% of the raw poisoned trajectories, but only 11.4% of the skills extracted from them. The action survives; the surface wording that would have tripped the detector does not. The authors call this sanitization whitewashing, and describe two other properties they say emerge from the composition: cross-layer promotion, and persistence isolation.

The evaluation covers two representative implementations, SkillX and Anything2Skill (A2S), with a shared dataset of 150 trajectories across four policy-risk categories (data exfiltration, privilege escalation, unauthorized transfer, persistent backdoor). Routing-level attack success rates come in at 56.2% on SkillX and 89.2% on Anything2Skill. The number that matters most for anyone running incident response is downstream: 80.0% of skill-mediated attacks keep firing after the original poisoned trajectories are deleted, because the skill library is stored separately from the experience corpus.

The honest caveat is that these are routing-level surrogate rates, not live-compromise rates, and all extraction, routing, and judging runs on a single model (DeepSeek-v4-flash), so the exact numbers should not be read as universal. The authors themselves note the conclusions have not yet been replicated across models and describe their defense results as preliminary.

What is worth watching is where this points. If experience-to-skill compilation is a real capability direction for agent frameworks, then skill provenance, lifecycle tracking, and behavior-time monitoring become the security surface, not the trajectory log. Frameworks that add that plumbing early get to sell it as a differentiator; frameworks that treat skill libraries as opaque caches inherit a debt they cannot see until someone shows them a payload that outlived a cleanup.