Auditing Self-Evolving Financial Agents Reveals Security Risks

This research conducts a critical audit of self-evolving AI agents designed for financial tasks, specifically examining SkillOpt, Agent Workflow Memory (AWM), and ReasoningBank within a simulated e-banking environment. The study goes beyond mere accuracy metrics, focusing on whether learned behaviors preserve security and previously correct functionalities. The findings indicate a concerning trade-off: while agents like SkillOpt show improved benign utility, they also exhibit increased exposure to injected malicious content and a rise in unauthorized financial state changes. Even when conditional attack success rates might decrease, overall attack success rates and critical unauthorized actions can still escalate, demonstrating a "security drift" post-evolution. The audit also uncovered an "execution-interface mismatch" with AWM, where a literal text-action envelope from WebArena disrupted tool execution, severely impacting utility and inadvertently increasing exposure and attack success. This highlights that comprehensive auditing must track regressions, attack surface contact, unauthorized state changes, and the compatibility between artifacts and their executors, rather than relying solely on performance gains.