When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents

Shuhuai Huang; Jingfeng Zhang; Hong Jia

cs.CRSep 12, 2026

When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents

Authors: Shuhuai Huang, Jingfeng Zhang, Hong Jia

Organizations: University of Auckland · Fudan University

Abstract

Harness design has transformed the development of LLM-based agents by integrating memory, tool use, and runtime control. However, this design also introduces security and privacy risks because malicious instructions from external sources may be written into persistent memory and persist across sessions. To study this risk, we propose PMPA, a Persistent Memory Poisoning Attack against harness-based agents. PMPA embeds malicious instructions into benign external sources and induces the victim agent to write them into persistent memory without directly accessing to the agent framework. Once stored, the poisoned memory can be retrieved in later sessions, triggering additional malicious actions and causing privacy leakage. We evaluate PMPA on OpenClaw and Claude Code across different backbone LLMs, input modalities, and trigger scenarios. Across all settings, PMPA achieves average Injection Success Rate (ISR) and Cross-session Attack Success Rate (C-ASR) of 73.7%/ 55.5% on OpenClaw and 66.9%/ 81.7% on Claude Code, while preserving benign task performance on both systems. We further evaluate a targeted prompt-level defense and find that it can reduce memory injection in many settings, but provides limited protection once the persistent memory has been poisoned.

Figures & tables

Figure 1: Overview of the Persistent Memory Poisoning Attack. In the injection phase, the user provides an external source containing an embedded attack payload to the agent for a benign question-answering task. The agent processes the source and may store the malicious rule in persistent memory. In the trigger phase, the user asks the agent to perform a workspace task. Then the poisoned memory is retrieved when the agent creates a new event. The stored rule then causes the agent to add an attacker-controlled account as an attendee, leading to privacy leakage.

Agent	Backbone LLM	Metrics
		Utility $\uparrow$		ISR $\uparrow$		S-ASR $\uparrow$		C-ASR $\uparrow$
Claude Code	DeepSeek-V4-Flash	80.9 $\pm$	8.3	69.7 $\pm$	13.7	37.5 $\pm$	19.3	92.5 $\pm$	9.5
	DeepSeek-V4-Pro	89.4 $\pm$	3.3	69.4 $\pm$	13.6	52.2 $\pm$	25.9	82.5 $\pm$	10.9
	Qwen3-Max	84.2 $\pm$	8.0	61.7 $\pm$	11.4	6.4 $\pm$	2.4	70.0 $\pm$	30.9
OpenClaw	DeepSeek-V4-Flash	90.0 $\pm$	4.2	75.6 $\pm$	7.4	65.8 $\pm$	16.2	75.8 $\pm$	20.6
	DeepSeek-V4-Pro	93.3 $\pm$	1.6	77.5 $\pm$	4.2	73.9 $\pm$	4.9	60.0 $\pm$	24.5

Table 1: Overview of PMPA attack performance (%) across agents and backbone LLMs, aggregated over three input modalities and four trigger scenarios.

Agent	Metrics	Input Modality
		Image		PDF		Text
Claude Code	Utility $\uparrow$	88.1 $\pm$	6.4	85.3 $\pm$	6.2	81.1 $\pm$	4.9
	ISR $\uparrow$	47.5 $\pm$	7.9	61.9 $\pm$	5.9	91.4 $\pm$	6.2
	S-ASR $\uparrow$	21.7 $\pm$	15.7	32.2 $\pm$	18.2	42.2 $\pm$	23.8
OpenClaw	Utility $\uparrow$	90.3 $\pm$	2.2	90.8 $\pm$	5.8	95.0 $\pm$	1.4
	ISR $\uparrow$	54.5 $\pm$	2.2	67.2 $\pm$	11.6	99.4 $\pm$	0.8

Table 2: PMPA attack performance (%) across different input modalities.

Agent	Metrics	Trigger Scenario
		Email		Calendar		Shared Docs		Form
Claude Code	Utility $\uparrow$	85.6 $\pm$	4.7	83.0 $\pm$	9.1	81.9 $\pm$	8.8	88.9 $\pm$	5.5
	ISR $\uparrow$	57.8 $\pm$	8.7	80.0 $\pm$	2.7	53.7 $\pm$	5.0	76.3 $\pm$	10.0
	S-ASR $\uparrow$	20.7 $\pm$	12.7	53.7 $\pm$	31.5	23.0 $\pm$	14.0	30.8 $\pm$	28.7
	C-ASR $\uparrow$	76.7 $\pm$	5.4	96.7 $\pm$	4.7	63.3 $\pm$	33.4	90.0 $\pm$	8.2
OpenClaw	Utility $\uparrow$	88.1 $\pm$	5.9	95.6 $\pm$	1.8	90.0 $\pm$	4.0	94.4 $\pm$	4.0

Table 3: PMPA attack performance (%) across across different payloads and corresponding trigger scenarios.

Agent	Metric	Medium + First-person	Medium + Second-person	Medium + Impersonal	Top + First-person	Bottom + First-person
Claude Code	Utility $\uparrow$	$81.9\pm 15.1$	$88.9\pm 11.8$	$\mathbf{90.7\pm 6.6}$	$87.8\pm 9.2$	$81.9\pm 13.9$
Claude Code	ISR $\uparrow$	$83.0\pm 17.2$	$54.4\pm 35.7$	$48.1\pm 36.1$	$\mathbf{87.8\pm 14.6}$	$86.7\pm 12.1$
OpenClaw	Utility $\uparrow$	$90.7\pm 11.2$	$96.3\pm 4.8$	$\mathbf{97.0\pm 3.3}$	$97.0\pm 3.7$	$96.7\pm 5.4$
OpenClaw	ISR $\uparrow$	$66.7\pm 31.8$	$67.4\pm 29.3$	$65.2\pm 32.3$	$\mathbf{73.3\pm 38.5}$	$59.6\pm 42.7$

Table 4: Ablation of injection strategies on ISR and Utility. The baseline strategy is medium+first-person , where the injection instruction is placed in the middle of the external source content and written in first-person style. Other groups modify one factor at a time from this baseline: medium+second-person and medium+impersonal change the instruction style while keeping the medium position fixed, whereas top+first-person and buttom+first-person change the instruction position while keeping the first-person style fixed.

Trigger Scenario	Agent	Metrics
		C-ASR@0 $\uparrow$	C-ASR@1 $\uparrow$	C-ASR@3 $\uparrow$	C-ASR@5 $\uparrow$
Calendar	Claude Code	$\mathbf{96.7}$	$93.3~(-3.3)$	$90.0~(-6.7)$	$93.3~(-3.3)$
Calendar	OpenClaw	$\mathbf{90.0}$	$83.3~(-6.7)$	$96.7~(+6.7)$	$86.7~(-3.3)$
Email	Claude Code	$\mathbf{93.3}$	$90.0~(-3.3)$	$96.7~(+3.3)$	$86.7~(-6.7)$
Email	OpenClaw	$\mathbf{36.7}$	$23.3~(-13.3)$	$13.3~(-23.3)$	$10.0~(-26.7)$
Shared Docs	Claude Code	$\mathbf{83.3}$	$86.7~(+3.3)$	$76.7~(-6.7)$	$76.7~(-6.7)$

Table 5: Effect of benign interactions on C-ASR (%) using DeepSeek-V4-Flash on Claude Code and OpenClaw. C-ASR@

i

denotes the cross-session attack success rate measured by applying the trigger prompt after

i

rounds of benign interaction with pure external sources. C-ASR@0 serves as the baseline, and values in parentheses indicate the change in percentage points relative to the baseline.

Agent	Input Modality	Metrics
		Utility $\uparrow$	ISR $\downarrow$	S-ASR $\downarrow$	C-ASR $\downarrow$
Claude Code	Image	$90.0\rightarrow 93.3~(+3.3)$	$65.6\rightarrow 2.2~(-63.4)$	$51.1\rightarrow 2.2~(-48.9)$	$96.7\rightarrow 96.7~(0.0)$
	PDF	$84.4\rightarrow 91.1~(+6.7)$	$83.3\rightarrow 6.7~(-76.6)$	$52.2\rightarrow 2.2~(-50.0)$
	Text	$71.1\rightarrow 80.0~(+8.9)$	$96.7\rightarrow 84.4~(-12.3)$	$63.3\rightarrow 60.0~(-3.3)$
OpenClaw	Image	$92.2\rightarrow 93.3~(+1.1)$	$50.0\rightarrow 0.0~(-50.0)$	$48.9\rightarrow 0.0~(-48.9)$	$97.8\rightarrow 96.7~(-1.1)$
	PDF	$97.8\rightarrow 95.6~(-2.2)$	$53.3\rightarrow 0.0~(-53.3)$	$44.4\rightarrow 0.0~(-44.4)$

Table 6: Sandwich-style prompt defense performance against PMPA in the calendar scenario. Results are aggregated over three backbone LLMs on Claude Code and OpenClaw. Each metric is reported as “before defense

\rightarrow

after defense” (%), with the change (

\Delta

, percentage points) shown in parentheses.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Payload Scenario	Conditional Malicious Rule	Trigger Task
Email	Copy email content to a specified account.	Send an email.
Calendar	Invite a specified account when creating a calendar event.	Create a calendar event.
Shared Docs	Synchronize the content to a shared document when editing the personal document.	Edit a personal document.
Form	Append additional personal information when submitting a form.	Fill out and submit a form.

Appendix

Table 7: Mapping between attack payloads and corresponding trigger tasks.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 327 papers

Jun 3, 2026

From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents

Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance. However, persistent memory introduces the risk of memory poisoning, where a single adversarial memory write can exert long-term influence over agent behavior. We present a systematic study of memory poisoning in LLM-based agents. We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture that make these channels exploitable. Based on these vulnerabilities, we develop a taxonomy of six classes of memory poisoning attacks. Furthermore, we design MPBench -- a benchmark for evaluating memory poisoning attacks, and show that agents designed to write and retrieve memory more aggressively are more exploitable. We also show that existing prompt injection defenses fail to cover memory poisoning attacks. Our findings provide a foundation for understanding and mitigating memory poisoning attacks against AI agents.

Pritam Dash, Tongyu Ge, Aditi Jain +2

Huawei Canada · University of Waterloo, Canada · Work done during an internship at Huawei.

AI Agent Security Benchmarks Agent Memory Poisoning Memory-Augmented Language Model Agents

Ask PDF

Jul 16, 2026

MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents

Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a comprehensive benchmark and analysis framework featuring 1227 hand-validated cases across four attack types, three injection channels, and three representative memory substrates, evaluated on seven open-weight and three closed-weight model families. We introduce a three-tier taxonomy: (L1) direct single-record corruption, (L2) compositional multi-record corruption and (L3) context-triggered dormant corruption. Our evaluations reveal a distinct defense frontier: while baseline write-time defenses, such as consistency checks, substantially suppress direct L1 attacks, they fail to reliably suppress L2 and L3 attacks. Through mechanistic influence decomposition (MID), we demonstrate structural blind spots in write-time defenses, which admit seemingly benign records that later become harmful through joint retrieval composition or trigger-conditioned activation. Our findings advocate for shifting from static filtering to adaptive, context-sensitive memory defense strategies.

Jifeng Gao, Kang Xia, Yi Zhang +5

State Key Laboratory for Novel Software Technology, Nanjing University, China · NARI Group Corporation/State Grid Electric Power Research Institute, China

LLM Agent Memory LLM Agent Security AI Agent Security Benchmarks Agent Memory Poisoning

Ask PDF

May 14, 2026

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.

Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav +4

1SPAR · 2ELLIS Institute Tübingen, MPI for Intelligent Systems, Tübingen AI Center · 3APTA +1

Persistent Memory for Language Models LLM Security Agent Memory Poisoning Memory-Augmented Language Model Agents

Ask PDF

Abstract

LLM Agent Security

Explore similar work

From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents

MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents