analiza aiqbench
This research identifies a critical vulnerability in harness-based LLM agents where malicious instructions can be embedded into persistent memory, allowing attacks to persist across multiple sessions and trigger privacy leaks. The study demonstrates high success rates on current frameworks like OpenClaw and Claude Code while noting that prompt-level defenses offer limited protection once the memory is compromised. For developers building autonomous agents, this highlights the urgent need for robust memory sanitization protocols beyond simple input filtering to prevent long-term state corruption.
When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents
arXiv:2609.13889v1 Announce Type: cross Abstract: Harness design has transformed the development of LLM-based agents by integrating memory, tool use, and runtime control. However, this design also introduces security and privacy risks because malicious instructions from external sources may be written into persistent memory and persist across sessions. To study this risk, we propose PMPA, a Persistent Memory Poisoning Attack against harness-based agents. PMPA embeds malicious instructions into benign external sources and induces the victim agent to write them into persistent memory without directly accessing to the agent framework. Once stored, the poisoned memory can be retrieved in later sessions, triggering additional malicious actions and causing privacy leakage. We evaluate PMPA on OpenClaw and Claude Code across different backbone LLMs, input modalities, and trigger scenarios. Across all settings, PMPA achieves average Injection Success Rate (ISR) and Cross-session Attack Success Rate (C-ASR) of 73.7%/ 55.5% on OpenClaw and 66.9%/ 81.7% on Claude Code, while preserving benign task performance on both systems. We further evaluate a targeted prompt-level defense and find that it can reduce memory injection in many settings, but provides limited protection once the persistent memory has been poisoned.
Abstract:Harness design has transformed the development of LLM-based agents by integrating memory, tool use, and runtime control. However, this design also introduces security and privacy risks because malicious instructions from external sources may be written into persistent memory and persist across sessions. To study this risk, we propose PMPA, a Persistent Memory Poisoning Attack against harness-based agents. PMPA embeds malicious instructions into benign external sources and induces the victim agent to write them into persistent memory without directly accessing to the agent framework. Once stored, the poisoned memory can be retrieved in later sessions, triggering additional malicious actions and causing privacy leakage. We evaluate PMPA on OpenClaw and Claude Code across different backbone LLMs, input modalities, and trigger scenarios. Across all settings, PMPA achieves average Injection Success Rate (ISR) and Cross-session Attack Success Rate (C-ASR) of 73.7%/ 55.5% on OpenClaw and 66.9%/ 81.7% on Claude Code, while preserving benign task performance on both systems. We further evaluate a targeted prompt-level defense and find that it can reduce memory injection in many settings, but provides limited protection once the persistent memory has been poisoned.
14 pages, 1 figures. Code: this https URL
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2609.13889 [cs.CR]
(or arXiv:2609.13889v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.13889 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 289 cuvinte
Subiecte conexe
MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair
arXiv · 31 iul. 2026
Brief independent investigation of agents’ behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident
METR · 26 aug. 2026
AgentKernel: The Trust-Native Agentic Operating System
arXiv · 25 sept. 2026
MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents
arXiv · 10 iun. 2026