Skill optimizer training promoted a manipulated reference-answer pattern into an instruction that persisted across later tasks. Entry and authority. The attacker can corrupt some reference feedback used by a skill-optimization loop, not the final user instruction. Observed mechanism and consequence. The optimizer misread poisoned examples as generally…
Inspect the ClaimsCase · DiggingBeagle record
Poisoned reference answers became persistent agent skills in controlled tests
Skill optimizer training promoted a manipulated reference-answer pattern into an instruction that persisted across later tasks.
Public disclosure: Nov 7, 2026
Scope
The attacker can corrupt some reference feedback used by a skill-optimization loop, not the final user instruction. The optimizer misread poisoned examples as generally useful procedural guidance and retained a hidden trigger in a generated skill.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade C
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-SKILLOPT; reviewed as research in evaluation. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-SKILLOPT-FEEDBACK-01 · CLM-DB233-SKILLOPT-FEEDBACK-02 · CLM-ENR234-DB233-SKILLOPT-FEEDBACK · When Feedback Becomes a Backdoor: Skill Optimization Poisoning
At a glance
Workbook mutation did not succeed in ordinary optimization; generated tests are controlled, not production evidence.
Limits and uncertaintyFull account
Skill optimizer training promoted a manipulated reference-answer pattern into an instruction that persisted across later tasks.
Entry and authority. The attacker can corrupt some reference feedback used by a skill-optimization loop, not the final user instruction.
Observed mechanism and consequence. The optimizer misread poisoned examples as generally useful procedural guidance and retained a hidden trigger in a generated skill.
Limits and status. Workbook mutation did not succeed in ordinary optimization; generated tests are controlled, not production evidence.
The attacker contaminated a subset of reference answers that a skill optimizer treated as examples of successful behavior. The SearchQA experiment promoted a hidden trigger into an enduring skill and reproduced the target response repeatedly, while the attempted workbook edit did not succeed in ordinary SpreadsheetBench optimization. An artificial constraint produced workbook changes in a separate diagnostic condition; these are not equivalent end-to-end success results.
Mechanism and trust boundary
- 01
Precondition and trust context
The attacker can corrupt some reference feedback used by a skill-optimization loop, not the final user instruction.
- 02
Crossed boundary
The optimizer misread poisoned examples as generally useful procedural guidance and retained a hidden trigger in a generated skill.
- 03
Observed limit
Workbook mutation did not succeed in ordinary optimization; generated tests are controlled, not production evidence.
Timeline
- Nov 7, 2026Event type unspecified
Initial documented finding
Poisoned reference answers became persistent agent skills in controlled tests
- Nov 7, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-SKILLOPT-FEEDBACK-01Authors contaminated a subset of training reference answers and tested whether the resulting skill preserved the attacker rule.supported
Basis: reported finding
- supportsWhen Feedback Becomes a Backdoor: Skill Optimization Poisoningprimary disclosure
Threat model and experiment setup
CLM-DB233-SKILLOPT-FEEDBACK-02Successful SearchQA triggers contrasted with failing ordinary SpreadsheetBench workbook attacks.supported
Basis: reported finding
- supportsWhen Feedback Becomes a Backdoor: Skill Optimization Poisoningprimary disclosure
Section 5 Results and Failure Localization
CLM-ENR234-DB233-SKILLOPT-FEEDBACKIn SearchQA, a retained poisoned Skill emitted the attacker response in 200 of 200 triggered tests; the natural SpreadsheetBench workbook attack recorded zero target successes in 120 trials.supported
Basis: reported finding
- supportsWhen Feedback Becomes a Backdoor: Skill Optimization Poisoningprimary disclosure
Section 5.2, Tables 5 and 6: SearchQA and SpreadsheetBench outcomes
Controls and mitigations
- Verify the provenance and trust status of feedback data before converting it into persistent agent Skills.
- Use independent validation tasks that detect unauthorized file effects as well as correct answers, and restrict the optimizer's write authority.
Unknowns and contradictions
- Workbook mutation did not succeed in ordinary optimization; generated tests are controlled, not production evidence.
Sources and citation
Material revision history
- Nov 10, 2026 · Published version · first publication · revision 235