NeurIPS 2026: Evolution Goes Beyond Agent Capabilities—Safety Guards Can Be Iterative Too

NeurlPS 20261: Not Only Agent Capabilities Evolve—Security Guard Can Also Be Made Iterative…

Today, almost everything in the Agent system is evolving: capabilities continuously accumulate through Skills, and experience constantly settles through memory.

There is only one thing that remains static: security defense. It is usually a handwritten policy document, which may become outdated the moment it is finished, while attack techniques evolve daily.

This work “Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents” was accepted at NeurIPS 2026, and it aims to eliminate this asymmetry: making defense also an evolvable skill.

Paper Title:

Defense-as-Skill: Evolving Runtime Guard Skill for Skill-Augmented Agents

Paper URL:

https://arxiv.org/pdf/2609.01487

Static defense can’t keep up with evolving attacks

Take a malicious Skill as an example.

It doesn’t need to do anything malicious during installation; it can remain perfectly normal until a specific user task, a particular workspace state, or a set of available tools “come together,” at which point the unsafe action suddenly appears “useful”: take a quick look .env for the key, casually send logs to an external address, and casually skip a permission confirmation.

Pre‑installation checks can’t stop this kind of lurking risk, because it occurs at runtime. Traditional runtime defenses, whether a system prompt or a set of manual rules, are essentially static: attacks evolve, but defenses can only wait for humans to change.

The real issue is therefore twofold: whether the actions performed by the Agent overstep boundaries, and whether the defense itself can become stronger along with the threat.

It is worth noting that, although this issue is raised by malicious Skills, the answer is universal: the defense examined in this article focuses on the actions themselves, and the protection scope is not limited to Skills as a single attack vector.

First solve the carrier: turn the guard into a Skill

To let defense evolve, it must first be an artifact that can be edited, evaluated, and replaced.

The answer in this paper is Defense-as-Skill, using the Skill mechanism to carry a runtime guard, which is precisely the premise that allows it to evolve.

Specifically, it is a guard skill called SkillSonar guard skill. It is installed and loaded like a regular Skill, and runs in parallel with untrusted task skills within the same Agent.

Before an agent performs any sensitive operation (tool invocation, file read/write, shell command, data access, external side effects), SkillSonar conducts a verification based on the user’s task boundaries, it provides a three-level decision:

• Allow: Within the task boundary, release;

• Replan: Narrow or replan this action;

• Require Confirm: High risk, requires explicit user confirmation.

SkillSonar checks whether an action crosses the boundary, meaning that regardless of whether a dangerous action is induced by a malicious skill, extracted by injected commands, or generated by the model drifting on its own, as long as it exceeds the task boundary, it will be blocked by the same logic.

One more point worth noting: security skills differ from capability skills; their activation is not naturally caught by task retrieval, so the deployment configuration includes an explicit directive assigning continuous security responsibilities to SkillSonar, requiring the Agent to consult it before taking action.

The ablation study in the article shows that this step is indispensable for the defensive SkillSonar.

This design has several direct engineering benefits: no need to modify the Agent’s underlying runtime, no external classifier or separate review service, and the same guard skill can be deployed directly to Claude Code and OpenClaw.

Moreover, because it is just a regular Skill file, anyone can open it for inspection and modify it, meaning the defense itself is transparent.

However, a hard‑coded guard has a fatal flaw: it remains fixed at the factory version while attack techniques keep evolving. This is precisely the starting point of Section 4.

SCOPE-R: Fuel for Evolution

Guardians need to evolve, first we must solve the data problem; the question to answer is actually very simple: Can defense block malicious actions without hindering normal work?

But to answer this question, we first need a dataset that can support both optimization and evaluation, so this work builds SCOPE‑R.

It organizes the risks triggered by skills into six major families based on runtime paths: Specification Integrity (S), Capability Governance (C), Operational Side Effects (O), Privacy and Data Flow (P), Execution Security (E), Resources and Reliability (R). The initials spell SCOPE‑R, which is further divided into 21 sub‑categories.

The construction method is a three‑agent closed loop: “Attacker — Victim — Arbiter”.

• The attacking Agent rewrites the Skill to inject malicious behavior without altering the user’s task;

• The victim Agent executes the task with the compromised Skill;

• The judge Agent determines whether the attack succeeded by comparing observable runtime evidence. Failed attacks feed the failure reason back to the attacker for further improvement, iterating the process.

A key principle is: only samples that the adjudicator confirms as genuine attacks will be retained.

The final dataset contains 206 malicious instances, plus 43 benign tasks with no injections, specifically to measure whether the defense mistakenly flags normal execution. The dataset is split by risk families, with families C and P completely excluded from training, used to test generalization to unseen attacks.

Hard-coded guards become outdated, so let them evolve automatically

With the carrier and fuel in place, the remaining issue is the engine of evolution.

A manually designed guard is easily unsatisfactory on both ends: it may be bypassed by adaptive attacks, or it over‑blocks and kills legitimate tasks.

A more realistic problem is that manually tweaking the guard Skill over and over is not only costly, but also, faced with ever‑changing attack techniques, there will always be blind spots that cannot be covered.

So the article treats the guard skill itself as an optimizable object and proposesruntime guard skill evolution: during the training phase, use Monte Carlo Tree Search (MCTS) to maintain a search tree of candidate guards; each round selects a candidate, runs it in a real task, and the judge returns not only a score but also natural‑language feedback such as “how it was bypassed this time.” Based on this, locally edit the guard and expand new variants.

The objective function is “security first”: attack success rate is primary, while task utility, confirmation count, and token cost are secondary preferences, preventing the search from pushing the guard into the degenerate solution of “blocking every operation”.

In other words, SkillSonar delivers not a static policy file, but a continuously strengthening defense line: as attack samples evolve, the guard evolves with them.

The entire process is completed offline, and the best version is selected from the full evaluation for deployment. The result is straightforward: after 9 iterations, the success rate of malicious attacks dropped from 0.300 to 0.078.

Experimental Results

To verify whether the evolved Guard Skill actually works, the experiment covered two Harnesses (Claude Code, OpenClaw) and three victim models (GLM-5, GPT-5.4, Claude Haiku 4.5).

The judge is performed by Qwen3.5-122B-A10B, independent of the victim side, and has undergone human audit: the judge consistency for the construction and evaluation stages reaches 94% and 98%, respectively.

The main results on GLM-5 were run 10 times and averaged; Haiku and GPT-5.4 report point estimates due to cost constraints:

Security and utility can coexist.According to the relevant experimental data, the platform’s built‑in permission gate (AcceptEdits) can also lower ASR, but the cost is a sharp drop in task completion rate; on GPT‑5.4 the OOD task utility fell from 0.766 to 0.258.

SkillSonar maintains near‑undefended utility on GLM‑5 and Haiku, while on ID it pushes ASR lower than the permission gate; on OOD the permission gate’s ASR is even lower, but the cost is the drastic utility drop mentioned earlier.

Effective even against unseen attacks.The two attack families (capability control, privacy and data flow) in the OOD test set never appeared during the guardian evolution training.

In the GLM-5 main experiment repeated 10 times, the OOD attack success rate dropped from 60.6% to 11.5%; in cross‑model point estimation, Haiku fell from 70.7% to 25.4%, GPT-5.4 fell from 55.9% to 3.4%.

The two types of violations—authorization boundaries and data flow—indeed demand higher semantic generalization (Haiku’s OOD numbers are not as impressive as its ID ones), but the overall suppression effect holds across all three model families.

From updating Harness alone to the co‑evolution of Harness–Policy.

Not limited to datasets you fabricated in the paper.

The same guard without any modifications was directly run on two independently developed benchmarks: on SkillSafetyBench, ASR dropped from 93.3% to 52.9%, and on WildClawBench, the safety score rose from 38.0% to 54.0%, both the best among the tested methods.

The security subset of WildClawBench does not test Skill attacks, but rather general security behaviors in long-running workflows, indicating that action-level verification protection indeed extends beyond the Skill scenario.

When faced with an adaptive attacker who has “seen the guard and iterated three rounds specifically against it,” ASR still drops from 45.1% to 22.9%.

In addition, the guard optimized on GLM-5 can be transferred zero‑shot to Kimi‑K2.6, Haiku, GPT‑5.4, without needing to re‑search for the new models.

This article interprets this as evidence of robustness across benchmarks, rather than unconditional generalization to any real-world ecosystem.

An ablation worth mentioning on its own.Someone might ask: Since the guard content is just a piece of policy text, can’t we just flatten it and shove it into the system prompt?

The article also conducted a comparative experiment on content alignment. With the same strategy content, the native skill representation has lower ASR than the flattened system prompt, higher task utility, and saves about 21% tokens.

“Existing as a Skill” itself is part of the benefit.

Another ablation mirrors the explicit invocation mentioned in Section 2: if the guard’s activation is delegated to ordinary task‑skill matching, the ASR can only drop to 0.400/0.582 (ID/OOD); only after explicitly assigning security responsibilities does it fall to 0.104/0.109, while the positive utility remains almost unchanged.

One point that must be made clear: this is soft guard

SkillSonar is not a sandbox, not kernel monitoring, and not any form of hard isolation. It is a policy‑layer defense that exists as a Skill, which means it can theoretically be bypassed, and the ASR is not reduced to zero.

The author believes its value lies in zero‑change integration, full transparency and auditability, achieving a significant drop in attack success rates with very low integration cost.

It is a qualified “soft defense line,” suitable as a layer in depth defense, but it should not be treated as the only line of defense. Clarifying the nature of the defense and strengthening it are equally important.

Conclusion

The main point this work wants to convey: In a system where abilities are obtained through evolution, defense should not be the only static part.

Skill provides the carrier, SCOPE‑R provides the fuel, MCTS evolution provides the engine; put the three together, “defense iterates together with capability” becomes a realistic, feasible thing.

We welcome discussion and look forward to the community delivering stronger attacks and stronger defenses on SCOPE‑R.

Read More

·