arXiv Machine Learning October 22, 2026 By Pedro H. Barcha Correia, Matheus Azevedo de S\'a, Paulo H. Gomes de Senna, Giovanni Mandel Martignago, Victor Takashi Hayashi, Charles Christian Miers, Marcos A. Simplicio Jr

Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise

Read the original on arXiv Machine Learning →

The paper investigates a new vulnerability called memory injection, where malicious prompts can persist across sessions in modern LLM‑as‑a‑service platforms. By demonstrating that all NIST attack goals can be achieved on ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash, the authors show that these services can spread disinformation, generate harmful content, or cause offline unresponsiveness even in fresh sessions. The study also reveals that many proposed defenses are not yet implemented and provides datasets and artifacts for further research.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv Machine Learning.

arXiv AI

Jun 4

What If Prompt Injection Never Left? Exploring Cross-Session Stored Prompt Injection in Agentic Systems

arXiv:2606. 04425v1 Announce Type: cross Abstract: Modern agentic systems transform LLMs from session-bounded assistants into stateful systems that persist and evolve shared world state across sessions through memories, filesystems, tools, and other long-lived contextual artifacts.

By Yuanbo Xie, Tianyun Liu, Yingjie Zhang, Suchen Liu, Yulin Li, Liya Su, Tingwen Liu

llms agents benchmarks safety

arXiv AI

Jun 10

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

arXiv:2606. 10749v1 Announce Type: cross Abstract: Large language model (LLM) agents are rapidly moving from conversational interfaces to software components that plan, invoke tools, maintain memory, and act on external environments.

By Yuchen Ling, Shengcheng Yu, Zhenyu Chen, Chunrong Fang

llms agents benchmarks

arXiv AI

Jun 16

FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion

arXiv:2606. 15609v1 Announce Type: cross Abstract: Large language model (LLM) agents increasingly rely on long-term memory to support complex task execution, user personalization, and domain adaptation.

By Zixin Rao, Wentian Zhu, Chan Aristella Lu, Zhaorun Chen, Wei Niu, Le Guan, Bo Li, Zhen Xiang

llms agents fine-tuning benchmarks

arXiv AI

Sep 30

Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses in LLM Agents

arXiv:2605.01970v4 Announce Type: replace-cross Abstract: Memory systems enable otherwise stateless LLM agents to persist user information across sessions, but also introduce a new attack surface. Th...

By Debeshee Das, Julien Piet, Darya Kaviani, Luca Beurer-Kellner, Florian Tram\`er, David Wagner

llms rag agents multimodal benchmarks safety

arXiv AI

Jul 2

Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces

arXiv:2607. 00481v1 Announce Type: cross Abstract: Jailbreak attacks remain a critical threat to the safe deployment of large language models (LLMs).

By Junlong Liu, Haobo Wang, Weiqi Luo, Xiaojun Jia

llms benchmarks safety

arXiv AI

Jun 2

Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models

arXiv:2606. 00150v1 Announce Type: cross Abstract: As Large Language Models evolve for user convenience, vulnerability to jailbreak attacks continues to be reported despite ongoing efforts in safety training.

By Junyoung Park, Seongyong Ju, Sunghwan Park, Jaewoo Lee

llms safety

One email a morning, machine-written

Related stories

What If Prompt Injection Never Left? Exploring Cross-Session Stored Prompt Injection in Agentic Systems

Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation

FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion

Trojan Hippo Bench: A Dynamic Benchmark for Persistent Memory Attacks and Defenses in LLM Agents

Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces

Persona Attack: Incremental Memory Injection Jailbreak Attack against Large Language Models