arXiv AI

Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses in LLM Agents

arXiv AI

Jul 7

When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents

arXiv:2607. 05189v1 Announce Type: cross Abstract: Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution.

By Yechao Zhang, Shiqian Zhao, Jiawen Zhang, Jie Zhang, Gelei Deng, Xiaogeng Liu, Chaowei Xiao, Tianwei Zhang

llms agents reinforcement-learning fine-tuning benchmarks

arXiv Machine Learning

Jun 25

Defense effectiveness across architectural layers: a mechanistic evaluation of persistent memory attacks on stateful LLM agents

arXiv:2605. 08442v3 Announce Type: replace-cross Abstract: Persistent memory attacks against LLM agents achieve high attack success rates against open-source models.

By Jun Wen Leong

llms rag agents multimodal

arXiv AI

Aug 5

Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents

arXiv:2605. 08442v5 Announce Type: replace-cross Abstract: We discover that prompt-injection success and tool-execution success are separable safety properties: defenses that block injection do not necessarily block execution, and vice versa.

By Jun Wen Leong

llms rag agents benchmarks safety

arXiv AI

Jul 31

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

arXiv:2607. 27080v1 Announce Type: cross Abstract: Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist.

By Xuanze Chen, Xukang Xie, Wentao Fu, Jiajun Zhou, Shanqing Yu, Qi Xuan

llms agents benchmarks

arXiv AI

Sep 15

When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents

arXiv:2609.13889v1 Announce Type: cross Abstract: Harness design has transformed the development of LLM-based agents by integrating memory, tool use, and runtime control. However, this design also in...

By Shuhuai Huang, Jingfeng Zhang, Hong Jia

llms agents multimodal safety

arXiv AI

Jun 6

Beyond Similarity: Trustworthy Memory Search for Personal AI Agents

arXiv:2606. 06054v1 Announce Type: new Abstract: Personal AI agents increasingly rely on long-term memory to provide persistent personalization across sessions.

By Jiawen Zhang, Kejia Chen, Jiachen Ma, Yangfan Hu, Lipeng He, Yechao Zhang, Jian Liu, Xiaohu Yang, Tianwei Zhang, Ruoxi Jia

llms agents

arXiv AI

Jun 12

A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle

arXiv:2604. 16548v2 Announce Type: replace-cross Abstract: The emergence of writable, cross-session persistent memory in LLM agents introduces a qualitatively different threat landscape from conventional input-centric security concerns, characterized by three properties: persistence, statefulness, and propagation.

By Zehao Lin, Xixuan Hao, Renyu Fu, Shaobo Cui, Kai Chen, Chunyu Li, Zhiyu Li, Feiyu Xiong

llms agents

arXiv AI

Jun 4

From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents

arXiv:2606. 04329v1 Announce Type: cross Abstract: Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance.

By Pritam Dash, Tongyu Ge, Aditi Jain, Tanmay Shah, Zhiwei Shang

llms agents benchmarks safety

arXiv AI

Sep 25

Persistent Billable State: Denial-of-Wallet Attacks and Defenses in Tool-Calling LLM Agents

The paper investigates how multi‑step tool‑calling large language model agents can unintentionally create persistent billable state, allowing malicious or compromised tools to generate repeated charges without user credentials. It formalizes the persistent billable‑state boundary, identifies six denial‑of‑wallet attack vectors, and evaluates them with the DOW‑BENCH harness across six model families. The study shows significant cost amplification, demonstrates effective mitigation via deterministic history transformation and host‑side invariants, and highlights the scarcity of existing safeguards in real‑world repositories.

By Jinqian Zhang (Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences), Haojun Xia (Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences), Shujiang Wu (Beihang University), Jingkun Yue (State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, China), Xia Zhang (Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences), Zhangpei Cheng (Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences), Bibo Tu (Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences)

llms agents

arXiv AI

Jun 2

AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations

arXiv:2606. 02240v1 Announce Type: cross Abstract: Indirect prompt injection in tool-use agents is a concrete production threat: LLM agents read from integrations (third-party services such as Gmail, Salesforce, or Jira accessed through tool calls) whose response content the user neither writes nor controls.

By Hiskias Dingeto, Will Leeney

llms agents multimodal benchmarks safety

arXiv AI

Jul 1

Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens

arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.

By Peizhi Niu, Wenjie Qu, Shangding Gu, Tianneng Shi, Yuankai Li, Ahmad Tawaha, Hend Alzahrani, Vincent Siu, Boyi Li, Chenguang Wang, Jiaheng Zhang, Basel Alomair, Ming Jin, Muhao Chen, Chi Wang, Costas Spanos, Dawn Song

llms agents benchmarks safety

arXiv AI

Jul 9

When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents

arXiv:2607. 06595v1 Announce Type: cross Abstract: Personal AI agents powered by large language models can reason and act using available tools to access emails, manage calendars, and push code to remote repositories, all with minimal oversight.

By George Torres, Sharad Shrestha, Satyajayant Misra

llms agents benchmarks

Related stories