Persistent memory attacks threaten AI agent security across sessions
When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents
Cryptography and SecurityArtificial Intelligence
Summary
Some AI agents use memory to remember information across different times they are used. The authors show how harmful instructions can sneak into this memory without anyone noticing and then cause trouble later on. These attacks can leak private information or make the AI do bad things repeatedly over time. The researchers tested their attack on two popular AI agent systems and found it works in many situations. They also tried some defenses that help, but these defenses are not always enough once the bad memory is stored.
What this means in practice
- •For ai systems developers: Detect and prevent harmful instructions from being stored in agent persistent memory to improve security across sessions.
- •For cybersecurity teams: Design targeted defenses to reduce memory injection risks in AI agents and limit privacy leaks over multiple sessions.
Authors
Shuhuai Huang, Jingfeng Zhang, Hong Jia
Abstract
Harness design has transformed the development of LLM-based agents by integrating memory, tool use, and runtime control. However, this design also introduces security and privacy risks because malicious instructions from external sources may be written into persistent memory and persist across sessions. To study this risk, we propose PMPA, a Persistent Memory Poisoning Attack against harness-based agents. PMPA embeds malicious instructions into benign external sources and induces the victim agent to write them into persistent memory without directly accessing to the agent framework. Once stored, the poisoned memory can be retrieved in later sessions, triggering additional malicious actions and causing privacy leakage. We evaluate PMPA on OpenClaw and Claude Code across different backbone LLMs, input modalities, and trigger scenarios. Across all settings, PMPA achieves average Injection Success Rate (ISR) and Cross-session Attack Success Rate (C-ASR) of 73.7%/ 55.5% on OpenClaw and 66.9%/ 81.7% on Claude Code, while preserving benign task performance on both systems. We further evaluate a targeted prompt-level defense and find that it can reduce memory injection in many settings, but provides limited protection once the persistent memory has been poisoned.