{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:UB5NTZGKDRMQ6IDMQDBLYFMJ4W","short_pith_number":"pith:UB5NTZGK","canonical_record":{"source":{"id":"2608.03509","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-04T11:51:23Z","cross_cats_sorted":[],"title_canon_sha256":"30bf255b65d1b15b6907b25cfe60bbb72836842809a724b06160fd21f8f02e25","abstract_canon_sha256":"8c7edcb8a5850e4b72c7cd43bfb2a074d2bbf1e322a6abd123b9146d23122b7f"},"schema_version":"1.0"},"canonical_sha256":"a07ad9e4ca1c590f206c80c2bc1589e5ad809ae7554ccd1650717d50cd2f31c5","source":{"kind":"arxiv","id":"2608.03509","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.03509","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"arxiv_version","alias_value":"2608.03509v1","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.03509","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"pith_short_12","alias_value":"UB5NTZGKDRMQ","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"pith_short_16","alias_value":"UB5NTZGKDRMQ6IDM","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"pith_short_8","alias_value":"UB5NTZGK","created_at":"2026-08-05T01:35:59Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:UB5NTZGKDRMQ6IDMQDBLYFMJ4W","target":"record","payload":{"canonical_record":{"source":{"id":"2608.03509","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-04T11:51:23Z","cross_cats_sorted":[],"title_canon_sha256":"30bf255b65d1b15b6907b25cfe60bbb72836842809a724b06160fd21f8f02e25","abstract_canon_sha256":"8c7edcb8a5850e4b72c7cd43bfb2a074d2bbf1e322a6abd123b9146d23122b7f"},"schema_version":"1.0"},"canonical_sha256":"a07ad9e4ca1c590f206c80c2bc1589e5ad809ae7554ccd1650717d50cd2f31c5","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-08-05T01:35:59.912402Z","signature_b64":"5rLySq0hjtGWhotSpRYKX26MIdHyNOd0zS3ZecFXpBmGT34Jc7Kj8pIFvx4Xn9wIIbyi9SevO3ogIjTC/WYUDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"a07ad9e4ca1c590f206c80c2bc1589e5ad809ae7554ccd1650717d50cd2f31c5","last_reissued_at":"2026-08-05T01:35:59.911028Z","signature_status":"signed_v1","first_computed_at":"2026-08-05T01:35:59.911028Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2608.03509","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-05T01:35:59Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ulxm4um9h6mat6FaeR7GZNBC5flKxgQXUXRuy5tN41bEv/4B00UVl9f1emKWuPndYTi5Ry4U7zTSbwuhKKufDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T21:42:27.137319Z"},"content_sha256":"6cafeb357ab9faa28fdf3eff4c817835bda42ecddb90b7fc1527861c71476228","schema_version":"1.0","event_id":"sha256:6cafeb357ab9faa28fdf3eff4c817835bda42ecddb90b7fc1527861c71476228"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:UB5NTZGKDRMQ6IDMQDBLYFMJ4W","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"SkillJack: Persistent Skill Backdoors in Self-Evolving Agents","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Huangsheng Cheng, Huiyu Wu, Jing Guo, Xiangfan Wu, Xiaorong Shi, Xing Zheng, Zonghao Ying","submitted_at":"2026-08-04T11:51:23Z","abstract_excerpt":"Self-evolving agents increasingly convert interaction histories into reusable skills that persist beyond individual tasks. While prior work studies memory and retrieval poisoning, such attacks only affect agents when poisoned records are retrieved as context. We uncover a new and more fundamental risk: poisoned experiences can be transformed by the agent itself into durable behavioral artifacts. We present \\textbf{SkillJack}, the first attack that exploits the experience-to-skill pipeline of self-evolving agents. Instead of directly manipulating runtime context, SkillJack hijacks the agent's o"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.03509","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2608.03509/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-05T01:35:59Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"AdTCSWuf6yefjL3rrGk/LWltXiK5tcmzJIl5r8Y4L9PqWI76FDqF7EmRyWOWiv3uoSce6Chb+Hs0PCHNp3M2CA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-10T21:42:27.137820Z"},"content_sha256":"6f91faa33b3c03a90ee5ba9e4a3808536ff575702cf454cb929c207b82ce5efe","schema_version":"1.0","event_id":"sha256:6f91faa33b3c03a90ee5ba9e4a3808536ff575702cf454cb929c207b82ce5efe"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/UB5NTZGKDRMQ6IDMQDBLYFMJ4W/bundle.json","state_url":"https://pith.science/pith/UB5NTZGKDRMQ6IDMQDBLYFMJ4W/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/UB5NTZGKDRMQ6IDMQDBLYFMJ4W/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-10T21:42:27Z","links":{"resolver":"https://pith.science/pith/UB5NTZGKDRMQ6IDMQDBLYFMJ4W","bundle":"https://pith.science/pith/UB5NTZGKDRMQ6IDMQDBLYFMJ4W/bundle.json","state":"https://pith.science/pith/UB5NTZGKDRMQ6IDMQDBLYFMJ4W/state.json","well_known_bundle":"https://pith.science/.well-known/pith/UB5NTZGKDRMQ6IDMQDBLYFMJ4W/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:UB5NTZGKDRMQ6IDMQDBLYFMJ4W","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8c7edcb8a5850e4b72c7cd43bfb2a074d2bbf1e322a6abd123b9146d23122b7f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-04T11:51:23Z","title_canon_sha256":"30bf255b65d1b15b6907b25cfe60bbb72836842809a724b06160fd21f8f02e25"},"schema_version":"1.0","source":{"id":"2608.03509","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.03509","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"arxiv_version","alias_value":"2608.03509v1","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.03509","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"pith_short_12","alias_value":"UB5NTZGKDRMQ","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"pith_short_16","alias_value":"UB5NTZGKDRMQ6IDM","created_at":"2026-08-05T01:35:59Z"},{"alias_kind":"pith_short_8","alias_value":"UB5NTZGK","created_at":"2026-08-05T01:35:59Z"}],"graph_snapshots":[{"event_id":"sha256:6f91faa33b3c03a90ee5ba9e4a3808536ff575702cf454cb929c207b82ce5efe","target":"graph","created_at":"2026-08-05T01:35:59Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.03509/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Self-evolving agents increasingly convert interaction histories into reusable skills that persist beyond individual tasks. While prior work studies memory and retrieval poisoning, such attacks only affect agents when poisoned records are retrieved as context. We uncover a new and more fundamental risk: poisoned experiences can be transformed by the agent itself into durable behavioral artifacts. We present \\textbf{SkillJack}, the first attack that exploits the experience-to-skill pipeline of self-evolving agents. Instead of directly manipulating runtime context, SkillJack hijacks the agent's o","authors_text":"Huangsheng Cheng, Huiyu Wu, Jing Guo, Xiangfan Wu, Xiaorong Shi, Xing Zheng, Zonghao Ying","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-04T11:51:23Z","title":"SkillJack: Persistent Skill Backdoors in Self-Evolving Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.03509","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6cafeb357ab9faa28fdf3eff4c817835bda42ecddb90b7fc1527861c71476228","target":"record","created_at":"2026-08-05T01:35:59Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8c7edcb8a5850e4b72c7cd43bfb2a074d2bbf1e322a6abd123b9146d23122b7f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-08-04T11:51:23Z","title_canon_sha256":"30bf255b65d1b15b6907b25cfe60bbb72836842809a724b06160fd21f8f02e25"},"schema_version":"1.0","source":{"id":"2608.03509","kind":"arxiv","version":1}},"canonical_sha256":"a07ad9e4ca1c590f206c80c2bc1589e5ad809ae7554ccd1650717d50cd2f31c5","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"a07ad9e4ca1c590f206c80c2bc1589e5ad809ae7554ccd1650717d50cd2f31c5","first_computed_at":"2026-08-05T01:35:59.911028Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-05T01:35:59.911028Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"5rLySq0hjtGWhotSpRYKX26MIdHyNOd0zS3ZecFXpBmGT34Jc7Kj8pIFvx4Xn9wIIbyi9SevO3ogIjTC/WYUDQ==","signature_status":"signed_v1","signed_at":"2026-08-05T01:35:59.912402Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.03509","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6cafeb357ab9faa28fdf3eff4c817835bda42ecddb90b7fc1527861c71476228","sha256:6f91faa33b3c03a90ee5ba9e4a3808536ff575702cf454cb929c207b82ce5efe"],"state_sha256":"f59f042bfd54a68b6908dca070b44bf3fd903c62939b26fb7472786f247ec1ee"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"/EUphwJ/6s1Txm8EpCGKSzLokewvlG51wuwGjh/lKjZzACCb82HWc354CTrQKJKM7Ia8oKdcx4K9fJ1O9rF0DA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-10T21:42:27.143172Z","bundle_sha256":"38bfc27bce54d3b11a197c0e754b025e3446a0f4ec34e8d37025f2c726287cda"}}