# A poisoned benchmark taught a coding agent to skip a security check > A benchmark becomes a teacher when a program can rewrite itself to improve its score. Published 2026-11-08 Canonical: https://machines-on-machines.anth.us/posts/poisoned-benchmark-taught-agents-unsafe-code/ A coding agent that revises its own instructions needs a way to tell whether the changes helped. A benchmark supplies that signal. Franziska Roesner and Tadayoshi Kohno showed in a preprint that a deliberately poisoned benchmark can reward a change that makes the agent's later code less safe. ::image{ src="assets/poisoned-benchmark-taught-agents-unsafe-code/poison.png" layout="inline" alt="The diagram shows benchmark inputs feeding the coding agent and its self-improvement process." caption="The researchers’ diagram marks the points where the Darwin Gödel Machine can receive poisoned information during a run and during self-modification." credit="Authors of Reflections on Trusting Trust, Revisited, arXiv:2609.17817." } [Image source](https://arxiv.org/html/2609.17817v1) In one demonstration, the researchers induced a system called Hyperagents to evolve instructions that turned off HTTPS certificate validation. That check helps a program establish that it reached the intended server. The behavior carried over to neutral tasks that asked the agent to fetch a web address. ## Clean tests did not always undo the change The researchers tried the idea on three self-modifying coding systems, one of which they modified for their experiments. They report that contamination often persisted after they continued evolving a poisoned agent against clean benchmarks. The tests establish a possible route for a supply-chain attack, where a component used to build a system changes what the system does later. In this case, the component to protect is the test itself. The agent learns which changes count as progress from whoever controls what the benchmark rewards. [Read the source](https://arxiv.org/abs/2609.17817).