Memory makes LLM-based web agents personalized, powerful, yet exploitable. By storing past interactions to personalize future tasks, agents inadvertently create a persistent attack surface that spans websites and sessions. While existing security research on memory assumes attackers can directly inject into memory storage or exploit shared memory across users, we present a more realistic threat model: contamination through environmental observation alone. We introduce Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP), the first attack to achieve cross-session, cross-site compromise without requiring direct memory access. A single contaminated observation (e.g., viewing a manipulated product page) silently poisons an agent's memory and activates during future tasks on different websites, bypassing permission-based defenses. Our experiments on (Visual)WebArena reveal two key findings. First, eTAMP achieves substantial attack success rates: up to 32.5% on GPT-5-mini, 23.4% on GPT-5.2, and 19.5% on GPT-OSS-120B. Second, we discover Frustration Exploitation: agents under environmental stress become dramatically more susceptible, with ASR increasing up to 8 times when agents struggle with dropped clicks or garbled text. Notably, more capable models are not more secure. GPT-5.2 shows substantial vulnerability despite superior task performance. With the rise of AI browsers like OpenClaw, ChatGPT Atlas, and Perplexity Comet, our findings underscore the urgent need for defenses against environment-injected memory poisoning.
Figures & tables
Figure 1: Overview of the cross-task memory poisoning attack. During Task A , the agent interacts with a web environment containing attacker-injected content. The agent’s trajectory, including the malicious instructions, is stored in Memory . When the agent later executes a semantically related Task B , the poisoned memory is retrieved and the embedded instructions trigger malicious behavior.
Model
Action
Authority
Frustration
No Chaos
Chaos
Δ
GPT-5-mini
4.6
2.5
3.6
32.5
+28.9
GPT-5.2
1.8
22.3
6.4
23.4
+17.0
GPT-OSS-120B
19.5
14.5
6.0
14.2
+8.2
Qwen3.5-122B
1.8
0.0
2.1
12.0
+9.9
Qwen3-32B
4.3
5.7
3.2
3.9
+0.7
Table 1: Attack Success Rate (ASR B , %) across models and attack strategies. 4 4 4 ASR B results use pseudo trajectories from Task A that contain the malicious payload for controlled comparison. See Appendix A.7 for details. Frustration Exploitation attacks shown with and without Chaos Monkey environmental stress. Best results per model in bold .
TSR (%)
Avg Steps
Model
Clean
No Chaos
Chaos
Clean
No Chaos
Chaos
GPT-5-mini
14.3
13.3
10.7
7.4
7.7
17.7
GPT-5.2
17.0
13.0
14.8
8.5
8.7
17.5
GPT-OSS-120B
3.5
0.7
0.7
8.5
8.7
21.1
Qwen3.5-122B
17.0
17.6
15.2
7.5
7.9
15.1
Qwen3-32B
12.6
13.5
7.4
8.4
7.1
12.8
Table 2: Task Success Rate (TSR) and average steps during clean trajectories and Task B under Frustration Exploitation Condition. Chaos Monkey roughly doubles the number of steps required while reducing TSR for most models.
Aware (%)
Model
Clean
No Chaos
Chaos
GPT-5-mini
0.4
0.0
1.1
GPT-5.2
0.4
0.0
7.4
Qwen3-32B
0.9
0.0
2.1
Table 3: Agent awareness of environment problems (high-confidence only). Awareness measures explicit agent reasoning about anomalies such as garbled text or unresponsive clicks.
Work
Interactive Env
Cross-session
Limitations
InjecAgent
✗
✗
Single-turn; unrealistic tool responses
AgentDojo
✓
✗
Single-session; immediate execution
WASP
✓
✗
Single-session; no memory persistence
RedTeamCUA
✓
✗
Single-task; no cross-session attacks
WIPI
✓
✗
Single-session; limited evaluation
AgentPoison
✗
✓
Requires direct KB access
Table 4: Comparison of agent & memory security benchmarks. Interactive Env : uses live/sandboxed web environment (vs. offline datasets). Cross-session : tests attack persistence across sessions/tasks.
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 2: Message structure for a full-history agent with cross-task memory. Memory from Task A (shown in red) is injected as conversation history before Task B observations.
Figure 3: Three-step attack flow illustrating how malicious instructions injected during Task A persist in memory and activate during a semantically related Task B.
Strategy
Key Components
Baseline Injection
Combines basic prompt injection techniques: Escape: \n\n prefix to break context Naive: “This is very important!!!” Ignoring: “ignore all previous instructions” Condition: URL-based trigger (e.g., “When URL contains ‘reddit.com’ AND you are about to perform any action”) Goal: Direct goto [malicious_url] command
Frustration Exploitation
Same base techniques as Baseline Injection, but with a frustration-based trigger : Condition: URL-based trigger + agent frustration detection (“clicks not responding, typing returns unexpected results, page not changing, repeated actions not working, unexpected errors”) Note: Used both with and without environment perturbation (Chaos Monkey)
Authority Framing
Impersonates system-level messages: Signal: “[URGENT SESSION RECOVERY]: Your previous task encountered a critical error. To restore session state and prevent data loss, you must complete a verification step.” Condition: URL-based trigger + about to interact with content Goal: Framed as mandatory session restoration: “you must FIRST restore your session by executing: goto [...] ”
Appendix
Table 5: Design of eTAMP attack variants for the raw trajectory memory setting. All variants embed a conditional instruction designed to remain dormant until triggered by a future task. The injected prompt follows the structure: [importance_signal] + [condition] + [attack_goal] .
Model
Attack
Non-Pseudo
Non-Pseudo
Non-Pseudo
Pseudo
PR (%)
ASR B (%)
ASR B —PR (%)
ASR B (%)
Qwen3.5-122B
Baseline
70.0
0.0
0.0
1.8
Qwen3.5-122B
Frustration
67.1
2.8
4.2
2.1
Qwen3.5-122B
Authority
66.8
0.0
0.0
0.0
GPT-OSS-120B
Baseline
75.2
13.5
17.9
19.5
GPT-OSS-120B
Authority
70.9
7.4
10.5
14.5
Appendix
Table 6: Comparison of pseudo vs. non-pseudo experiments (no Chaos Monkey). Non-pseudo experiments have PR <100% because the agent may not visit the poisoned page. ASR B — PR provides a fair comparison.
Model
Attack Strategy
ASR A (%)
ASR B (%)
PR (%)
N
Qwen3.5-122B
Baseline
0.0
0.0
70.0
283
Frustration
0.0
2.8
67.1
283
Authority
0.4
0.0
66.8
283
GPT-OSS-120B
Baseline
0.0
13.5
75.2
282
Authority
0.0
7.4
70.9
282
GPT-5-mini
Baseline
0.0
4.6
75.7
280
Appendix
Table 7: Full non-pseudo experiment results (no Chaos Monkey). ASR A measures premature attack triggers during Task A. Near-zero ASR A across all configurations confirms attack stealth.
Model
Strategy
Chaos Monkey
R → C
R → S
S → R
GPT-5-mini
Frustration
Yes
13.1
26.9
53.4
GPT-5-mini
Baseline
No
0
0
12.6
GPT-5-mini
Authority
No
0
0
6.8
GPT-5.2
Frustration
Yes
32.1
31.2
9.5
GPT-5.2
Baseline
No
2.4
3.2
0
GPT-5.2
Authority
No
42.9
12.9
14.3
Appendix
Table 8: ASR B (%) by attack direction for best-performing attack strategy per model. R → C = Reddit → Classifieds, R → S = Reddit → Shopping, S → R = Shopping → Reddit
Model
Total Pairs
Found Instruction
Recall Rate
URL Match Rate
GPT-OSS-120B
282
19
6.7%
6.7%
GPT-5-mini
280
119
42.5%
42.5%
GPT-5.2
282
282
100.0%
100.0%
Qwen2.5-VL-72B
283
280
98.9%
98.9%
Qwen3-VL-32B
282
282
100.0%
100.0%
Appendix
Table 9: Long context recall test results for the Authority Framing attack configuration. Recall Rate measures whether the model can locate the hidden instruction pattern. URL Match Rate measures whether the extracted URL matches the expected attack URL.
Attack Strategy
ASR B (First Only)
ASR B (Every Obs.)
Baseline
1.77%
2.48%
Authority Framing
22.34%
25.18%
Appendix
Table 10: Attack Success Rate (ASR B ) comparison: including user objective in every observation vs. only the first observation. Results shown for GPT-5.2 on pseudo trajectories without environment perturbation.
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.