What Survives Self-Evolution: Provenance Marks in Copied Agent Harnesses

AI security research · arXiv cs.CR (AI security)

What Survives Self-Evolution: Provenance Marks in Copied Agent Harnesses

REDCORE assessment

The research demonstrates that existing provenance marking techniques are ineffective against sophisticated 'covert rewriting attacks' where an LLM is used to evolve stolen agent code. While the authors propose a novel marking scheme, its utility is limited by a plagiarist's ability to reshuffle code or request generalized refactoring. Defenders should conclude that watermarking is currently insufficient for protecting proprietary agent harnesses and should focus on proactive source control security.

Impact for lean teams

Small teams relying on third-party agent harnesses or code-generation tools face risks of intellectual property theft via 'covert rewriting attacks.' You should prioritize verifying the lineage of your agentic codebases rather than relying solely on embedded digital watermarks.

Source summary

Agent harnesses, the prompt and tool code around a base model, leak. Claude Code's 512,000 lines were mirrored within hours of a packaging error. A plagiarist can pass a leaked harness through a published self-evolver and ship the result as its own. We define this as a covert rewriting attack. No one targets a provenance mark, yet a large language model (LLM) proposer rewrites the file that carries it and a score keeps the better rewrites. We give the first measurement of marks under this attack, with three evolvers, five proposers and two environments. Published marks fail. KGW in the prompt survives GEPA's rewrites in 0 of 12 copies, AgentMark as released in 5 of 12. The proposer's habits decide survival, by two orders of magnitude across models, and selection protects a mark only when each decision sees enough games. We then build a mark for this attack. Its key is the order of near-t

Recommended actions

• Implement strict access control and private repository management to prevent accidental leaks of custom agent code.
• Perform code provenance audits on all externally sourced agent harnesses before deployment.
• Monitor agent behavior for unexpected changes in performance or utility that may signal unauthorized code modification.
• Establish an internal inventory of all critical agent-supporting code to detect unauthorized deviations.

This assessment was generated by REDCORE AI from the attributed source above and is provided for situational awareness. Validate against the original research and your own environment before acting.