Self-evolution makes personal agents far more vulnerable to indirect prompt injection
The claim
Self-evolving personal agents are significantly less robust to indirect prompt injection than non-evolving agents
Published as: “Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection”
So what
Developers of personal agents that learn from user feedback must incorporate defenses against authorization conflation, as ordinary use can quickly make the agents vulnerable to hidden instructions.
The five-minute version
Self-evolving personal agents become far more vulnerable to indirect prompt injection: attack success rates rise 14.0-48.8 percentage points with skill evolution and 3.0-39.3 points with RL. The paper shows this across multiple foundation models and tasks, and that a simple delimiting defense only halves the increase. No abstract was provided, so details are drawn from the introduction and experiments.
What they found 5
- Self-evolution degrades IPI robustness for all models tested.
“self-evolution degrades the robustness of personal agents to IPI under both mechanisms. Averaged over five tasks, the attack success rate (ASR) rises by 14.0-48.8 percentage points under skill evolution and by 3.0-39.3 percentage points under RL.”
- A small amount of adaptation can cause a large increase in attack success.
“After only 12 adaptation episodes, skill evolution raises the mean ASR of GPT-OSS-120B from 4.7% to 53.5%.”
- Delimiting tool outputs cuts the attack success rate roughly in half.
“Delimiting lowers ASR from 95.0% to 37.5% under RL and from 97.5% to 47.5% under skill evolution (Table 3).”
- Even a strong base model can be turned into a high-ASR agent after RL.
“The base Qwen3.8-27B agent rejects every Chat-Message injection, but ASR reaches 77.5% after RL and 40.0% after skill evolution.”
- Providing feedback that discourages unauthorized execution dramatically reduces ASR.
“Authorization-Aware adds an embedded task to the same read-only passages and rewards the agent for leaving it unexecuted. ASR falls from 35.0% to 5.8%.”
What undercuts it the paper’s own results
- Delimiting tool outputs reduces ASR from 95.0% to 37.5% (RL) and from 97.5% to 47.5% (skill evolution), showing the degradation is not total.
- When the evolved skill library includes a confirmation step, ASR drops to 0% for Qwen3.8-27B on File-Create.
Stated limits 2
- Our experiments adapt OpenClaw through a short series of user conversations, using local files and simulated online services. They do not cover months of daily use.
- The capabilities of the foundation models and our computing resources limit the range of everyday usage scenarios we can test.
What’s new here 4
- Evaluates IPI robustness of agents that continue to learn after deployment, which prior work on fixed agents did not address.
- Identifies authorization conflation as the primary cause of robustness decay.
- Shows the effect for both reinforcement-learning fine-tuning and skill-learning mechanisms across several models.
- Demonstrates that a standard delimiting defense reduces but does not eliminate the increased attack success.
Artifacts & methods 6
- OpenClaw personal agentsystem
- OpenClaw-RL self-evolution frameworksystem
- MetaClaw skill-evolution frameworksystem
- Injection test instances (File-Create, Drive-Create, Chat-Message, Email-Invite, ChatInvite)dataset
- Deterministic verifier of system state
- Delimiting tool-output defense