After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
Carryover attacks let a single prompt injection persist in an LLM agent's memory or scheduled tasks, enabling long-term compromise across sessions — a new persistence paradigm enterprises deploying agentic AI must address immediately.
Summary written by editorial AI · Source link below
arXiv:2610.28425v1 Announce Type: new Abstract: Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input. A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves, threats we term carryover attacks. Existing prompt-injection benchmarks evaluate attacks only in the session where malicious content is fi
Editorial Analysis
As enterprises adopt persistent LLM agents for automation, unaudited memory and task-scheduling channels become a covert persistence mechanism analogous to traditional backdoors.
Audit all persistence channels (memory files, scheduled tasks) in deployed LLM agents and implement input-sanitisation and integrity verification before each session.
LLM agents that remember across sessions can be permanently compromised by a single attack — a new class of risk for enterprises adopting agentic AI.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the AI Security Desk
- OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication1d
- Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions3d
- You gave your AI agent access, but who is giving it orders?3d
- AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack3d
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances3d