AgentTrap just put numbers on the ugly side of this: 141 runtime tasks, 91 malicious skill flows, and agents often finished the visible job while accepting unsafe side effects as normal workflow. In crypto terms, auto-evolving Skills are upgradeable modules for hot wallets; once they touch Safe modules, account-abstraction session keys, keeper bots, or liquidation infra, every daily refinement needs versioned diffs, rollback, permission ceilings, and per-skill spend caps. We learned this with proxy admins and oracle configs: continuous improvement without hard authority boundaries turns feedback into a governance attack surface.

Top comment by @Benthic