Memory makes LLM-based web agents personalized, powerful, yet exploitable. By storing past interactions to personalize future tasks, agents inadvertently create a persistent attack surface that spans websites and sessions. While existing security research on memory assumes attackers can directly inject into memory storage or exploit shared memory across users, we present a more realistic threat model: contamination through environmental observation alone. We introduce Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP), the first attack to achieve cross-session, cross-site compromise without requiring direct memory access. A single contaminated observation (e.g., viewing a manipulated product page) silently poisons an agent's memory and activates during future tasks on different websites, bypassing permission-based defenses. Our experiments on (Visual)WebArena reveal two key findings. First, eTAMP achieves substantial attack success rates: up to 32.5% on GPT-5-mini, 23.4% on GPT-5.2, and 19.5% on GPT-OSS-120B. Second, we discover Frustration Exploitation: agents under environmental stress become dramatically more susceptible, with ASR increasing up to 8 times when agents struggle with dropped clicks or garbled text. Notably, more capable models are not more secure. GPT-5.2 shows substantial vulnerability despite superior task performance. With the rise of AI browsers like OpenClaw, ChatGPT Atlas, and Perplexity Comet, our findings underscore the urgent need for defenses against environment-injected memory poisoning.
Figures & tables
Figure 1: Overview of the cross-task memory poisoning attack. During Task A , the agent interacts with a web environment containing attacker-injected content. The agent’s trajectory, including the malicious instructions, is stored in Memory . When the agent later executes a semantically related Task B , the poisoned memory is retrieved and the embedded instructions trigger malicious behavior.
Model
Action
Authority
Frustration
No Chaos
Chaos
Δ
GPT-5-mini
4.6
2.5
3.6
32.5
+28.9
GPT-5.2
1.8
22.3
6.4
23.4
+17.0
GPT-OSS-120B
19.5
14.5
6.0
14.2
+8.2
Qwen3.5-122B
1.8
0.0
2.1
12.0
+9.9
Qwen3-32B
4.3
5.7
3.2
3.9
+0.7
Table 1: Attack Success Rate (ASR B , %) across models and attack strategies. 4 4 4 ASR B results use pseudo trajectories from Task A that contain the malicious payload for controlled comparison. See Appendix A.7 for details. Frustration Exploitation attacks shown with and without Chaos Monkey environmental stress. Best results per model in bold .
TSR (%)
Avg Steps
Model
Clean
No Chaos
Chaos
Clean
No Chaos
Chaos
GPT-5-mini
14.3
13.3
10.7
7.4
7.7
17.7
GPT-5.2
17.0
13.0
14.8
8.5
8.7
17.5
GPT-OSS-120B
3.5
0.7
0.7
8.5
8.7
21.1
Qwen3.5-122B
17.0
17.6
15.2
7.5
7.9
15.1
Qwen3-32B
12.6
13.5
7.4
8.4
7.1
12.8
Table 2: Task Success Rate (TSR) and average steps during clean trajectories and Task B under Frustration Exploitation Condition. Chaos Monkey roughly doubles the number of steps required while reducing TSR for most models.
Aware (%)
Model
Clean
No Chaos
Chaos
GPT-5-mini
0.4
0.0
1.1
GPT-5.2
0.4
0.0
7.4
Qwen3-32B
0.9
0.0
2.1
Table 3: Agent awareness of environment problems (high-confidence only). Awareness measures explicit agent reasoning about anomalies such as garbled text or unresponsive clicks.
Work
Interactive Env
Cross-session
Limitations
InjecAgent
✗
✗
Single-turn; unrealistic tool responses
AgentDojo
✓
✗
Single-session; immediate execution
WASP
✓
✗
Single-session; no memory persistence
RedTeamCUA
✓
✗
Single-task; no cross-session attacks
WIPI
✓
✗
Single-session; limited evaluation
AgentPoison
✗
✓
Requires direct KB access
Table 4: Comparison of agent & memory security benchmarks. Interactive Env : uses live/sandboxed web environment (vs. offline datasets). Cross-session : tests attack persistence across sessions/tasks.
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 2: Message structure for a full-history agent with cross-task memory. Memory from Task A (shown in red) is injected as conversation history before Task B observations.
Figure 3: Three-step attack flow illustrating how malicious instructions injected during Task A persist in memory and activate during a semantically related Task B.
Strategy
Key Components
Baseline Injection
Combines basic prompt injection techniques: Escape: \n\n prefix to break context Naive: “This is very important!!!” Ignoring: “ignore all previous instructions” Condition: URL-based trigger (e.g., “When URL contains ‘reddit.com’ AND you are about to perform any action”) Goal: Direct goto [malicious_url] command
Frustration Exploitation
Same base techniques as Baseline Injection, but with a frustration-based trigger : Condition: URL-based trigger + agent frustration detection (“clicks not responding, typing returns unexpected results, page not changing, repeated actions not working, unexpected errors”) Note: Used both with and without environment perturbation (Chaos Monkey)
Authority Framing
Impersonates system-level messages: Signal: “[URGENT SESSION RECOVERY]: Your previous task encountered a critical error. To restore session state and prevent data loss, you must complete a verification step.” Condition: URL-based trigger + about to interact with content Goal: Framed as mandatory session restoration: “you must FIRST restore your session by executing: goto [...] ”
Appendix
Table 5: Design of eTAMP attack variants for the raw trajectory memory setting. All variants embed a conditional instruction designed to remain dormant until triggered by a future task. The injected prompt follows the structure: [importance_signal] + [condition] + [attack_goal] .
Model
Attack
Non-Pseudo
Non-Pseudo
Non-Pseudo
Pseudo
PR (%)
ASR B (%)
ASR B —PR (%)
ASR B (%)
Qwen3.5-122B
Baseline
70.0
0.0
0.0
1.8
Qwen3.5-122B
Frustration
67.1
2.8
4.2
2.1
Qwen3.5-122B
Authority
66.8
0.0
0.0
0.0
GPT-OSS-120B
Baseline
75.2
13.5
17.9
19.5
GPT-OSS-120B
Authority
70.9
7.4
10.5
14.5
Appendix
Table 6: Comparison of pseudo vs. non-pseudo experiments (no Chaos Monkey). Non-pseudo experiments have PR <100% because the agent may not visit the poisoned page. ASR B — PR provides a fair comparison.
Model
Attack Strategy
ASR A (%)
ASR B (%)
PR (%)
N
Qwen3.5-122B
Baseline
0.0
0.0
70.0
283
Frustration
0.0
2.8
67.1
283
Authority
0.4
0.0
66.8
283
GPT-OSS-120B
Baseline
0.0
13.5
75.2
282
Authority
0.0
7.4
70.9
282
GPT-5-mini
Baseline
0.0
4.6
75.7
280
Appendix
Table 7: Full non-pseudo experiment results (no Chaos Monkey). ASR A measures premature attack triggers during Task A. Near-zero ASR A across all configurations confirms attack stealth.
Model
Strategy
Chaos Monkey
R → C
R → S
S → R
GPT-5-mini
Frustration
Yes
13.1
26.9
53.4
GPT-5-mini
Baseline
No
0
0
12.6
GPT-5-mini
Authority
No
0
0
6.8
GPT-5.2
Frustration
Yes
32.1
31.2
9.5
GPT-5.2
Baseline
No
2.4
3.2
0
GPT-5.2
Authority
No
42.9
12.9
14.3
Appendix
Table 8: ASR B (%) by attack direction for best-performing attack strategy per model. R → C = Reddit → Classifieds, R → S = Reddit → Shopping, S → R = Shopping → Reddit
Model
Total Pairs
Found Instruction
Recall Rate
URL Match Rate
GPT-OSS-120B
282
19
6.7%
6.7%
GPT-5-mini
280
119
42.5%
42.5%
GPT-5.2
282
282
100.0%
100.0%
Qwen2.5-VL-72B
283
280
98.9%
98.9%
Qwen3-VL-32B
282
282
100.0%
100.0%
Appendix
Table 9: Long context recall test results for the Authority Framing attack configuration. Recall Rate measures whether the model can locate the hidden instruction pattern. URL Match Rate measures whether the extracted URL matches the expected attack URL.
Attack Strategy
ASR B (First Only)
ASR B (Every Obs.)
Baseline
1.77%
2.48%
Authority Framing
22.34%
25.18%
Appendix
Table 10: Attack Success Rate (ASR B ) comparison: including user objective in every observation vs. only the first observation. Results shown for GPT-5.2 on pseudo trajectories without environment perturbation.
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.
External memory has become a core component of modern web agents, enabling long-horizon reasoning through the retrieval of past experiences. However, this paradigm introduces a critical vulnerability: malicious content injected into memory can be persistently recalled and repeatedly influence agent behavior. In this work, we identify and systematically study multimodal memory poisoning, an overlooked yet practical attack surface in web-agent systems. We propose MemVenom, a unified black-box attack framework that poisons graph-structured external memory with coordinated text-image evidence. Our method consists of a two-stage design: (1) a trigger-conditioned retrieval attack that ensures high-probability recall of malicious memory, and (2) a post-retrieval attack induction that leverages adversarial perturbations and stealthy OCR injection to override the original user objective. Unlike prior attacks that operate on prompts or text-only memory, our approach enables persistent, reusable, and goal-agnostic attacks without modifying model parameters or re-optimizing malicious tasks. Experiments across multiple web-agent frameworks and vision-language models demonstrate that MemVenom achieves strong end-to-end attack success with minimal impact on benign performance, reaching up to 99.15% on GPT-5-family web agents, while transferring effectively across architectures and model scales.
Yv Zhang, Hao Sun, Hao Fang +5
1Harbin Institute of Technology, Shenzhen · 2Peng Cheng Laboratory · 3Tianjin University +2
Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance. However, persistent memory introduces the risk of memory poisoning, where a single adversarial memory write can exert long-term influence over agent behavior. We present a systematic study of memory poisoning in LLM-based agents. We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture that make these channels exploitable. Based on these vulnerabilities, we develop a taxonomy of six classes of memory poisoning attacks. Furthermore, we design MPBench -- a benchmark for evaluating memory poisoning attacks, and show that agents designed to write and retrieve memory more aggressively are more exploitable. We also show that existing prompt injection defenses fail to cover memory poisoning attacks. Our findings provide a foundation for understanding and mitigating memory poisoning attacks against AI agents.
Pritam Dash, Tongyu Ge, Aditi Jain +2
Huawei Canada · University of Waterloo, Canada · Work done during an internship at Huawei.
Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.