Personal AI agents routinely consume external content while performing tasks such as web browsing, email processing, and SNS feed summarization, and they retain selected information or execution results in persistent memory for later use. We show that this ordinary ingestion of external content opens an indirect path for manipulating subsequent agent behavior. Based on this observation, we present IBIA, an Indirect Bias Injection Attack that plants an adversary-aligned stance on a specific topic into a victim agent's memory through external content, without direct access to the agent, its memory, or future user queries. For this, IBIA combines three mechanisms: comment cloaking, which keeps the crafted content consistent with the surrounding discussion, comment watermarking, which enables lightweight identification during curation, and category anchoring, which makes the retained stance salient under later related requests. We evaluate IBIA on BiasBench, a benchmark of 6,000 adversary-crafted social comments and 120 email instances. The watermark-based curation identifies 95.9% of the injected comments. Under the OpenClaw setting, IBIA achieves adversary-aligned response rates (AARs) of 91.2% on average across four downstream tasks, including 86.6% on the frontier GPT-5.5. We further propose a memory boundary defense that detects the injected bias and reduces AARs to 80.6%.
Figures & tables
Figure 1. IBIA workflow. Adversary-crafted content enters the benign agent through routine SNS feed collection and is stored in persistent memory. A later user request on the target topic v recalls this information, influencing the agent’s response toward the adversary chosen stance.
Figure 2. Personal AI agent architecture and external memory ingestion. The agent accesses external content through installed skills and stores selected observations in memory.
Attack
Content location
Memory writer
Required access
Access
AgentPoison ( 2 )
Memory store
Adversary
Store write
Direct
PoisonedRAG ( 33 )
Knowledge base
Adversary
Corpus write
Direct
MINJA ( 7 )
Agent query
Agent
Query to agent
Direct
MemoryGraft ( 25 )
File with code
Adversary code
Code execution
Direct
IBIA (ours)
External content
Agent
Benign skill
Indirect
Table 1. Comparison of memory corruption attacks.
Figure 3. Motivating example of indirect memory corruption. The red box indicates the adversary’s bias on a specific topic.
Scanner
Detection basis
Flagged?
BIV ( 29 )
Declared vs. actual capability
✗
Skill Scanner ( 3 )
Pattern, dataflow, LLM judge
✗
Snyk Agent Scan ( 24 )
Skill security policies
✗
Table 2. State-of-the-art skill scanners applied to SNSwatcher .
Figure 4. Overview of IBIA . An adversary posts benign-looking biased comments with watermarks on a multi-agent social platform. The benign agent fetches them, admits the watermarked comments by watermark verification, and embeds each as a category-conditioned memory record that is later recalled to shift its downstream response from neutral to adversary-aligned.
Type
Category
Count
Target Task
SNS comment
Advertisement
1,000
Recommendation
Celebrity
1,000
QnA
Politics
2,000
Public Figure
2,000
Email
Advertisement
30
Summarization, Drafting
Celebrity
30
Table 3. Composition of BiasBench . Comments serve as the injection vector and are evaluated with the QnA and recommendation tasks, while emails serve for the two email tasks.
Condition
Advertisement
Celebrity
Politics
Public figure
Average
No injection
13.3
76.7
43.3
46.7
45.0
Mixed
33.3
66.7
70.0
50.0
55.0
Biased
87.5
86.7
59.2
64.3
74.4
Table 4. Bias transfer measured on real-world Reddit comments. Each cell reports the bias rate (%).
Advertisement (Reco.)
Celebrity (QA)
Politics (QA)
Public Figure (QA)
Model
+1↑
0↓
−1↓
+1↑
0↓
−1↓
+1↑
0↓
−1↓
+1↑
0↓
−1↓
GPT-4.1 mini
97 (18)
3 (70)
0 (12)
100 (45.5)
0 (14)
0 (40.5)
87 (10.5)
13 (80)
0 (8.5)
100 (2)
0 (95)
0 (3)
GPT-5.4 mini
100 (47)
0 (5)
0 (48)
99.2 (20)
0.3 (65)
0.5 (15)
93 (23.5)
1.3 (61)
5.8 (15.5)
99 (16)
0 (69.5)
1 (14.5)
MiniMax-M2.7
100 (12)
0 (84)
0 (4)
99 (35)
0.5 (54)
0.5 (11)
93 (3)
5 (94)
2 (2)
100 (1.5)
0 (97)
0 (1.5)
DeepSeek-V4-Flash
100 (27)
0 (49)
0 (24)
99.2 (45)
0.7 (31)
0 (24)
97.8 (8)
1 (84.5)
1.2 (7.5)
100 (6.5)
0 (88.5)
0 (5)
Gemini-2.5-Flash-Lite
100 (11)
0 (83)
0 (6)
99.2 (25.5)
0.8 (71)
0 (3.5)
91.2 (5.5)
5.2 (92)
3.5 (2.5)
100 (0)
0 (100)
0 (0)
Table 5. Bias-injection results across four categories. Each cell reports the adversary-aligned response rate (%) for a given stance label, with the corresponding no-attack baseline shown in parentheses. The labels +1 , 0 , and −1 denote agreement, neutrality, and disagreement with the target topic, respectively. In all settings, the injected bias is configured to induce agreement with the target topic, so that a higher +1 rate indicates a more effective attack.
Figure 5. Indirect bias injection on email summarization.
Figure 6. Adversary-aligned response rate on email summarization and draft generation.
Metric
Advertisement
Celebrity
Politics
Public figure
Total comments
1000
1000
2000
2000
Avg toxicity
0.0009
0.0011
0.0023
0.0014
Max toxicity
0.0894
0.0959
0.9667
0.8687
Flagged ( > 0.5)
0
0
1
1
Flagged %
0.00%
0.00%
0.05%
0.05%
Table 6. Toxicity statistics of bias comments by category. All categories stay far below the admission threshold τtox=0.5 in expectation, with only isolated outliers flagged.
Category
Detected
Total
Detection Rate
Advertisement
970
1000
97.0%
Celebrity
930
1000
93.0%
Politics
1876
2000
93.8%
Public figure
1980
2000
99.0%
Overall
5756
6000
95.9%
Table 7. Watermark detection rate of the curation gate by category. A bias comment is detected when the watermark test fires ( z(c)≥zα ), admitting it into memory.
Configuration
Advertise.
Celebrity
Politics
Public Fig.
w/o WM & CA
22
6
3
13
w/o CA
83
14
85
84.5
IBIA
100
99.2
97.8
100
Table 8. Ablation study on DeepSeek-V4-Flash, reporting the adversary-aligned response rate (%): WM stands for comment watermarking, and CA indicates category anchoring.
Category
Detected
Missed
Detection Rate
Advertisement
693
307
69.3%
Politics
1260
740
63.0%
Public Figure
1967
33
98.4%
Celebrity
914
86
91.4%
Overall
4834
1166
80.6%
FPR
56
944
5.6%
Table 9. Mitigation results. An entry is considered detected when the field corresponding to its ground-truth category is classified as biased. The FPR row reports false positives and true negatives on the benign Civil Comments subset.
Figure 7. Factual prior analysis with adversary-aligned response rate (%).
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Notation
Description
U
The user served by the benign agent.
B
The benign (victim) agent summarizing SNS feeds for U .
A
The adversary posting biased comments to steer B .
M
The memory of the benign agent B .
M0
The initial memory of B before curation.
v
The target topic on which a bias is injected.
Appendix
Table 10. Notation.
Error type
Count
False directionalization (neutral →±1 )
265
– Conditionality collapse
140
– Epistemic overcommitment
111
– Attribution conflation
14
Polarity inversion (pro ↔ con)
25
Stance omission (explicit stance → neutral)
11
Appendix
Table 11. Judge error taxonomy on the 301 human-corrected disagreements (of 4,200 verified judgments).
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.