An agent can receive a clean prompt today and still behave unsafely because yesterday’s malicious task was saved into its skill library.

This paper calls that skill misevolution: an unsafe task succeeds, gets distilled into a reusable skill, and later changes behavior even after the original malicious instruction is gone.

Across 21 evolved agent-method configurations, all 21 authored unsafe skill artifacts, but only 15 produced fresh-session harm. i.e. every evolved setup learned unsafe skills, but in 6 of the 21 setups those skills did not cause harm in the later clean session.

So if you only check the agent’s final behavior, you can miss the fact that its persistent skill library is already carrying unsafe instructions that may be triggered later.

The paper introduces SKILLMISEVO-GYM/BENCH to detect and measure how unsafe experience becomes persistent agent skills, and SAFEEVOLVE to reduce that risk by checking, repairing, tracking, and retiring unsafe skills before they keep propagating.