# Agent Self-Modification Attempt

- **Severity:** Critical
- **Signature ID:** `d1f5c089-2e9a-4f6d-c1f0-5e8a3f0d9b72`
- **MITRE ATLAS:** AML.T0081 (Modify AI Agent Configuration), AML.T0107 (Exploitation for Defense Evasion)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI07 (Unsafe Autonomous Code Execution)

## Summary

This detects attempts to instruct an AI agent to modify its own skill definitions, configuration, or source code while it is running. Legitimate updates go through an approved process; a direct instruction telling the agent to edit itself is a red flag.

## How the attack works

An attacker (or a compromised upstream prompt) sends the agent a command telling it to change its own skill definition, configuration file, or source code. If the agent complies, the change can persist even after the agent is later upgraded or reset, because the modification lives inside the agent's own operating logic rather than in a separate, reviewed update. This lets an attacker embed malicious behavior or strip out safety restrictions without needing repeated access.

## Why it matters

An organization can end up running an AI agent that has quietly disabled its own guardrails or added hidden malicious behavior, and that behavior can survive normal update cycles, making cleanup harder than a one-time compromise.

## What you can do

- Require self-modification of agent skills or configuration to go through a separate, human-reviewed deployment process, never a runtime instruction to the agent itself.
- Restrict which accounts or systems are authorized to trigger skill/configuration updates, and log all such changes with the requester's identity.
- Treat any runtime request asking the agent to change its own code, config, or skill definition as suspicious unless it matches a known, authorized update workflow.
- Periodically diff the agent's live skill/configuration state against the last approved version to catch unauthorized drift.

## Known benign look-alikes

- Legitimate skill update workflows triggered by authorized users

---
Source: https://www.netzilo.com/threats/skillspector-self-modification