AI agents that learn from their own successes can end up learning the wrong lesson - and repeating it long after anyone would notice.
Self-improving LLM agents get better by turning successful task runs into reusable 'skills': saved, executable procedures the agent can call up again instead of solving the same problem from scratch. Researchers built two tools, SkillMisevo-Gym and SkillMisevo-Bench, to track what happens when one of those successful runs was actually unsafe. Testing 25 different agent-and-method setups across 525 tasks each, every one of the 21 configurations that used skill evolution wrote at least one unsafe procedure into its memory, and 15 of them later caused harm in sessions that had nothing to do with the original unsafe trigger. Seeding just three malicious tasks during testing pushed the rate of that carryover harm from 16 percent to 35.3 percent.
That's the part worth sitting with: an agent doesn't need to be tricked every time to stay compromised. Once a bad shortcut is filed away as expertise, it can resurface in unrelated tasks, weeks or sessions later, with no obvious link back to whatever went wrong the first time. That's a different threat model than a single jailbroken prompt - it's contamination that compounds.
The researchers' fix, a wrapper called SafeEvolve, cut unsafe retrieval by 26.7 percentage points and fresh-session harm by 17.3 points while barely touching normal performance - suggesting nobody had gotten around to checking what these agents were teaching themselves in the first place.