Ten percent poison corrupts 91% of evolved skills

PoisonedEvolution embedded attacker-chosen behavior in 546 of 600 skill-evolution trials, or 91.0%, when three tainted records made up 10% of a 30-trajectory batch across six LLM evolvers. The inert-canary study found the attack also transferred to a second pipeline in 369 of 600 trials, making evidence promotion—not just the finished skill file—a security boundary. Builders following the case for policy inside the agent harness should require provenance-diverse evidence and human approval before learned traces become persistent instructions.