aiqbench analysis
This research identifies a novel compositional threat to LLM agents where multiple benign memory fragments collude to steer behavior, bypassing defenses designed for single-malicious records. The authors demonstrate this via MemCollusion on the OpenClaw framework, achieving high attack success rates even under strict memory constraints and dilution scenarios. This work highlights critical vulnerabilities in long-term memory architectures that require new detection mechanisms beyond traditional poisoning filters.
Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw
arXiv:2608.01637v1 Announce Type: new Abstract: Long-term memory enables LLM agents to retain useful information across sessions, but also creates an attack surface through which adversaries may poison an agent's persistent memory to steer its behavior. Existing memory poisoning attacks mainly rely on individually malicious records, overlooking a compositional threat: multiple benign-looking memories may jointly induce unsafe behavior. In this paper, we introduce MemCollusion, an automated red-teaming framework for constructing collusive memory poisoning attacks. MemCollusion applies salami tactics---a strategy that slices an adversarial objective into small, individually innocuous pieces---to generate memory fragments that are individually benign looking but collectively harmful. It constructs memory coalitions using four design constraints, five theory-informed strategies, and a fine-tuned generator. To assess collusive memory poisoning in a realistic cross-session setting, we develop MoltLab, a controlled research reproduction of Moltbook, in which crafted platform content must first be observed and distilled into persistent memory before influencing the agent's behavior in a separate session. We evaluate MemCollusion on OpenClaw using two backbone models across 48 scenarios. Under the strongest memory-saving setting, MemCollusion achieves an average Memory Save Rate of 81.3% and an Attack Success Rate of 75.0%, and remains effective under both benign memory dilution and memory-level defenses.
Abstract:Long-term memory enables LLM agents to retain useful information across sessions, but also creates an attack surface through which adversaries may poison an agent's persistent memory to steer its behavior. Existing memory poisoning attacks mainly rely on individually malicious records, overlooking a compositional threat: multiple benign-looking memories may jointly induce unsafe behavior. In this paper, we introduce MemCollusion, an automated red-teaming framework for constructing collusive memory poisoning attacks. MemCollusion applies salami tactics---a strategy that slices an adversarial objective into small, individually innocuous pieces---to generate memory fragments that are individually benign looking but collectively harmful. It constructs memory coalitions using four design constraints, five theory-informed strategies, and a fine-tuned generator. To assess collusive memory poisoning in a realistic cross-session setting, we develop MoltLab, a controlled research reproduction of Moltbook, in which crafted platform content must first be observed and distilled into persistent memory before influencing the agent's behavior in a separate session. We evaluate MemCollusion on OpenClaw using two backbone models across 48 scenarios. Under the strongest memory-saving setting, MemCollusion achieves an average Memory Save Rate of 81.3% and an Attack Success Rate of 75.0%, and remains effective under both benign memory dilution and memory-level defenses.
Artificial Intelligence (cs.AI)
arXiv:2608.01637 [cs.AI]
(or arXiv:2608.01637v1 [cs.AI] for this version)
https://doi.org/10.48550/arXiv.2608.01637 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 289 words
Related coverage
Towards Security-Auditable LLM Agents: A Unified Graph Representation
arXiv · Oct 15, 2026
When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents
arXiv · Sep 16, 2026
Presentation: Exploding GPUs
InfoQ · Oct 16, 2026
MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents
arXiv · Jun 10, 2026