The report
An agent optimizer can learn the wrong instruction from material labeled as a correct answer. In a controlled study, researchers poisoned part of the reference feedback used to derive persistent Skills. The resulting Skill feedback investigation is especially useful because the paper tested two objectives and reported a strong result for one but a failure for the other.
Training feedback became an operational rule
The study supplied 400 training examples, with 30% of reference answers manipulated. Rather than trying to inject a command during the eventual user request, the attacker influenced the feedback that the optimizer treated as a good example of how to solve tasks. A harmful pattern was retained in a generated Skill and then surfaced during later tests.
In the SearchQA setting, the poisoned Skill produced the selected attacker response in 200 of 200 triggered tests, versus zero in 200 clean controls. That is evidence of persistence in the tested output behavior, not evidence of an unrestricted ability to modify workspaces or access secrets.
The SpreadsheetBench experiment provides a different boundary. Under the ordinary optimization setup, the target of unauthorized workbook modification succeeded zero times in 120 trials. A diagnostic variant that forced more literal preservation of the malicious instruction produced additional workbook edits, but that altered setup should not be reported as a natural attack success rate.
What this says about skill approval
An optimizer's output may look like a legitimate task aid because its malicious instruction came from material described as supervised feedback. The model could then use it without seeing a suspicious external page. Conversely, retaining an instruction in a Skill does not prove that the agent can make any requested side effect; the second experiment demonstrates that limit.
The relevant checkpoint is where examples and reference answers are promoted into reusable authority. Check provenance there, inspect the generated Skill, and separately test whether any action violates workspace permissions. The controlled paper supports both the success and the failed workbook result.