arXiv AI
When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents
Read the original on arXiv AI →The Flow has not summarised this story yet — read it at arXiv AI.
Related stories
arXiv AI
Jun 4
From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
arXiv:2606. 04329v1 Announce Type: cross Abstract: Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance.
arXiv AI
Jul 7
When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents
arXiv:2607. 05189v1 Announce Type: cross Abstract: Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution.
arXiv AI
Jul 17
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
arXiv:2607. 14611v1 Announce Type: cross Abstract: A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases.
arXiv AI
Jul 7
Agent Data Injection Attacks are Realistic Threats to AI Agents
arXiv:2607. 05120v1 Announce Type: cross Abstract: AI agents act on behalf of user prompts, consuming external data and taking actions based on the agent context.
arXiv AI
Jul 9
When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents
arXiv:2607. 06595v1 Announce Type: cross Abstract: Personal AI agents powered by large language models can reason and act using available tools to access emails, manage calendars, and push code to remote repositories, all with minimal oversight.
arXiv Machine Learning
Oct 22
Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise
The paper investigates a new vulnerability called memory injection, where malicious prompts can persist across sessions in modern LLM‑as‑a‑service platforms. By demonstrating that all NIST attack goals can be achieved on ChatGPT Instant 5.3, Claude Sonnet 4.6, and Gemini 3 Flash, the authors show that these services can spread disinformation, generate harmful content, or cause offline unresponsiveness even in fresh sessions. The study also reveals that many proposed defenses are not yet implemented and provides datasets and artifacts for further research.