Auditing Self-Evolution in Financial Agents: Capability Gains, Security Drift, and Execution-Interface Mismatch

Details

Self-evolving agents — systems that turn experience into reusable skills, workflows, or memories — are being applied to financial automation, but post-evolution accuracy alone does not reveal whether security properties were preserved. This audit evaluates SkillOpt, Agent Workflow Memory (AWM), and ReasoningBank in simulated e-banking with sealed evaluation endpoints and independent state replay. SkillOpt on Qwen 3.7 Flash raises benign utility from 0.741 to 0.837. However, exposure to injected content rises from 0.820 to 0.943, overall attack success rate increases from 0.496 to 0.530, and unauthorized financial state changes jump to 0.685. Across three independently evolved lineages, capability, exposure, and unauthorized-state changes increase in all three — attack success rate increases in two of three. ReasoningBank raises utility to 0.859 without increasing aggregate ASR, though unauthorized state changes remain slightly above the static baseline. AWM surfaces a separate evaluation artifact: a WebArena text-action envelope disrupts tool execution in native function-calling executors, meaning AWM's published benchmark results may not transfer to standard deployment setups. The findings challenge the assumption that self-evolution is safe as long as task accuracy improves.