Safety in Self-Evolving AgentsA Survey of Risks, Attacks, and Governance

Corpus

The coded pool follows the systematic scoping protocol of the survey (see the paper's survey-protocol appendix). Every count below is a corpus fact, not a field-wide prevalence estimate.

Abstract

Large language models (LLMs) exhibit strong general capabilities yet their parameters typically remain fixed after deployment, limiting learning from new interactions. In open-ended interactive environments, this characteristic motivates a shift toward self-evolving agents that continuously update reusable state (model parameters, memory entries, tool definitions, skill libraries, or workflows) using data, interactions, and accumulated experience.

This fundamentally changes the safety problem: when experience becomes reusable state, past events become future causes, and information that was harmless in one context may later influence decisions with greater persistence, authority, or scope. Beyond assessing whether a response is aligned or an action is authorized, self-evolving agent safety turns to whether safety properties survive the accumulation, generalization, and cross-context reuse of locally useful experience.

Existing surveys organize agent safety around components or lifecycle stages; we complement these views by tracing how a single piece of reusable influence, once written into state, changes its carrier, role, authority, and downstream consequences as the agent continues to evolve.

To support this analysis, we present SAVER, a transition-centered framework that analyzes safety through S×A→V→E→R: Substrate locates where reusable influence resides, Adaptation identifies the operation that transforms it, Violation characterizes which safety attributes are compromised, Exposure determines where and to whom the failure becomes observable, and Response evaluates whether the influence can be contained, repaired, or revoked. Treating the S×A transition as the analysis unit, SAVER traces how a given transition may induce violations, expand exposure surfaces, and demand containment responses.

Our survey reveals several key insights. Conceptually, safety failures need not originate from intrinsically harmful information; rather, otherwise legitimate state becomes unsafe when adaptation broadens its persistence, authority, or scope beyond the conditions under which it was originally valid. The reviewed work emphasizes admission, retrieval, activation, exposure, and local containment; evidence for descendant repair and evaluation after resumed adaptation remains sparse. Looking forward, we argue that evaluations must move beyond one-time measurements toward longitudinal evidence verifying whether unsafe influence can be traced to its originating transition, contained at its exposure surface, and prevented from re-emerging after continued adaptation.

@misc{chen2026safetyselfevolvingagentssurvey,
  title={Safety in Self-Evolving Agents: A Survey},
  author={Jiahao Chen and Zhou Feng and Oubo Ma and Yichen Yan and Ruixiao Lin and Hangtao Zhang and Linkang Du and Hengyu An and Yong Yang and Jun Liu and Junhao Li and Naen Xu and Chunyi Zhou and Yuan Su and Zehao Jin and Qianli Ma and Leyi Qi and Yiming Wang and Zhe Ma and Yuwen Pu and Mengyao Du and Yuanyi Song and Enhao Huang and Zhihui Fu and Jun Wang and Jinfeng Li and Yuefeng Chen and Hui Xue and Yiming Li and Tianyu Du and Shouling Ji},
  year={2026},
  eprint={2610.00093},
  archivePrefix={arXiv},
  primaryClass={cs.CR},
  url={https://arxiv.org/abs/2610.00093}
}