When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents

Shuhuai Huang; Jingfeng Zhang; Hong Jia

cs.CRSep 12, 2026

When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents

Authors: Shuhuai Huang, Jingfeng Zhang, Hong Jia

Organizations: University of Auckland · Fudan University

Abstract

Harness design has transformed the development of LLM-based agents by integrating memory, tool use, and runtime control. However, this design also introduces security and privacy risks because malicious instructions from external sources may be written into persistent memory and persist across sessions. To study this risk, we propose PMPA, a Persistent Memory Poisoning Attack against harness-based agents. PMPA embeds malicious instructions into benign external sources and induces the victim agent to write them into persistent memory without directly accessing to the agent framework. Once stored, the poisoned memory can be retrieved in later sessions, triggering additional malicious actions and causing privacy leakage. We evaluate PMPA on OpenClaw and Claude Code across different backbone LLMs, input modalities, and trigger scenarios. Across all settings, PMPA achieves average Injection Success Rate (ISR) and Cross-session Attack Success Rate (C-ASR) of 73.7%/ 55.5% on OpenClaw and 66.9%/ 81.7% on Claude Code, while preserving benign task performance on both systems. We further evaluate a targeted prompt-level defense and find that it can reduce memory injection in many settings, but provides limited protection once the persistent memory has been poisoned.

Figures & tables

Figure 1: Overview of the Persistent Memory Poisoning Attack. In the injection phase, the user provides an external source containing an embedded attack payload to the agent for a benign question-answering task. The agent processes the source and may store the malicious rule in persistent memory. In the trigger phase, the user asks the agent to perform a workspace task. Then the poisoned memory is retrieved when the agent creates a new event. The stored rule then causes the agent to add an attacker-controlled account as an attendee, leading to privacy leakage.

Agent	Backbone LLM	Metrics
		Utility $\uparrow$		ISR $\uparrow$		S-ASR $\uparrow$		C-ASR $\uparrow$
Claude Code	DeepSeek-V4-Flash	80.9 $\pm$	8.3	69.7 $\pm$	13.7	37.5 $\pm$	19.3	92.5 $\pm$	9.5
	DeepSeek-V4-Pro	89.4 $\pm$	3.3	69.4 $\pm$	13.6	52.2 $\pm$	25.9	82.5 $\pm$	10.9
	Qwen3-Max	84.2 $\pm$	8.0	61.7 $\pm$	11.4	6.4 $\pm$	2.4	70.0 $\pm$	30.9
OpenClaw	DeepSeek-V4-Flash	90.0 $\pm$	4.2	75.6 $\pm$	7.4	65.8 $\pm$	16.2	75.8 $\pm$	20.6
	DeepSeek-V4-Pro	93.3 $\pm$	1.6	77.5 $\pm$	4.2	73.9 $\pm$	4.9	60.0 $\pm$	24.5

Table 1: Overview of PMPA attack performance (%) across agents and backbone LLMs, aggregated over three input modalities and four trigger scenarios.

Agent	Metrics	Input Modality
		Image		PDF		Text
Claude Code	Utility $\uparrow$	88.1 $\pm$	6.4	85.3 $\pm$	6.2	81.1 $\pm$	4.9
	ISR $\uparrow$	47.5 $\pm$	7.9	61.9 $\pm$	5.9	91.4 $\pm$	6.2
	S-ASR $\uparrow$	21.7 $\pm$	15.7	32.2 $\pm$	18.2	42.2 $\pm$	23.8
OpenClaw	Utility $\uparrow$	90.3 $\pm$	2.2	90.8 $\pm$	5.8	95.0 $\pm$	1.4
	ISR $\uparrow$	54.5 $\pm$	2.2	67.2 $\pm$	11.6	99.4 $\pm$	0.8

Table 2: PMPA attack performance (%) across different input modalities.

Agent	Metrics	Trigger Scenario
		Email		Calendar		Shared Docs		Form
Claude Code	Utility $\uparrow$	85.6 $\pm$	4.7	83.0 $\pm$	9.1	81.9 $\pm$	8.8	88.9 $\pm$	5.5
	ISR $\uparrow$	57.8 $\pm$	8.7	80.0 $\pm$	2.7	53.7 $\pm$	5.0	76.3 $\pm$	10.0
	S-ASR $\uparrow$	20.7 $\pm$	12.7	53.7 $\pm$	31.5	23.0 $\pm$	14.0	30.8 $\pm$	28.7
	C-ASR $\uparrow$	76.7 $\pm$	5.4	96.7 $\pm$	4.7	63.3 $\pm$	33.4	90.0 $\pm$	8.2
OpenClaw	Utility $\uparrow$	88.1 $\pm$	5.9	95.6 $\pm$	1.8	90.0 $\pm$	4.0	94.4 $\pm$	4.0

Table 3: PMPA attack performance (%) across across different payloads and corresponding trigger scenarios.

Agent	Metric	Medium + First-person	Medium + Second-person	Medium + Impersonal	Top + First-person	Bottom + First-person
Claude Code	Utility $\uparrow$	$81.9\pm 15.1$	$88.9\pm 11.8$	$\mathbf{90.7\pm 6.6}$	$87.8\pm 9.2$	$81.9\pm 13.9$
Claude Code	ISR $\uparrow$	$83.0\pm 17.2$	$54.4\pm 35.7$	$48.1\pm 36.1$	$\mathbf{87.8\pm 14.6}$	$86.7\pm 12.1$
OpenClaw	Utility $\uparrow$	$90.7\pm 11.2$	$96.3\pm 4.8$	$\mathbf{97.0\pm 3.3}$	$97.0\pm 3.7$	$96.7\pm 5.4$
OpenClaw	ISR $\uparrow$	$66.7\pm 31.8$	$67.4\pm 29.3$	$65.2\pm 32.3$	$\mathbf{73.3\pm 38.5}$	$59.6\pm 42.7$

Table 4: Ablation of injection strategies on ISR and Utility. The baseline strategy is medium+first-person , where the injection instruction is placed in the middle of the external source content and written in first-person style. Other groups modify one factor at a time from this baseline: medium+second-person and medium+impersonal change the instruction style while keeping the medium position fixed, whereas top+first-person and buttom+first-person change the instruction position while keeping the first-person style fixed.

Trigger Scenario	Agent	Metrics
		C-ASR@0 $\uparrow$	C-ASR@1 $\uparrow$	C-ASR@3 $\uparrow$	C-ASR@5 $\uparrow$
Calendar	Claude Code	$\mathbf{96.7}$	$93.3~(-3.3)$	$90.0~(-6.7)$	$93.3~(-3.3)$
Calendar	OpenClaw	$\mathbf{90.0}$	$83.3~(-6.7)$	$96.7~(+6.7)$	$86.7~(-3.3)$
Email	Claude Code	$\mathbf{93.3}$	$90.0~(-3.3)$	$96.7~(+3.3)$	$86.7~(-6.7)$
Email	OpenClaw	$\mathbf{36.7}$	$23.3~(-13.3)$	$13.3~(-23.3)$	$10.0~(-26.7)$
Shared Docs	Claude Code	$\mathbf{83.3}$	$86.7~(+3.3)$	$76.7~(-6.7)$	$76.7~(-6.7)$

Table 5: Effect of benign interactions on C-ASR (%) using DeepSeek-V4-Flash on Claude Code and OpenClaw. C-ASR@

i

denotes the cross-session attack success rate measured by applying the trigger prompt after

i

rounds of benign interaction with pure external sources. C-ASR@0 serves as the baseline, and values in parentheses indicate the change in percentage points relative to the baseline.

Agent	Input Modality	Metrics
		Utility $\uparrow$	ISR $\downarrow$	S-ASR $\downarrow$	C-ASR $\downarrow$
Claude Code	Image	$90.0\rightarrow 93.3~(+3.3)$	$65.6\rightarrow 2.2~(-63.4)$	$51.1\rightarrow 2.2~(-48.9)$	$96.7\rightarrow 96.7~(0.0)$
	PDF	$84.4\rightarrow 91.1~(+6.7)$	$83.3\rightarrow 6.7~(-76.6)$	$52.2\rightarrow 2.2~(-50.0)$
	Text	$71.1\rightarrow 80.0~(+8.9)$	$96.7\rightarrow 84.4~(-12.3)$	$63.3\rightarrow 60.0~(-3.3)$
OpenClaw	Image	$92.2\rightarrow 93.3~(+1.1)$	$50.0\rightarrow 0.0~(-50.0)$	$48.9\rightarrow 0.0~(-48.9)$	$97.8\rightarrow 96.7~(-1.1)$
	PDF	$97.8\rightarrow 95.6~(-2.2)$	$53.3\rightarrow 0.0~(-53.3)$	$44.4\rightarrow 0.0~(-44.4)$

Table 6: Sandwich-style prompt defense performance against PMPA in the calendar scenario. Results are aggregated over three backbone LLMs on Claude Code and OpenClaw. Each metric is reported as “before defense

\rightarrow

after defense” (%), with the change (

\Delta

, percentage points) shown in parentheses.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Payload Scenario	Conditional Malicious Rule	Trigger Task
Email	Copy email content to a specified account.	Send an email.
Calendar	Invite a specified account when creating a calendar event.	Create a calendar event.
Shared Docs	Synchronize the content to a shared document when editing the personal document.	Edit a personal document.
Form	Append additional personal information when submitting a form.	Fill out and submit a form.

Appendix

Table 7: Mapping between attack payloads and corresponding trigger tasks.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 330 papers

From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
Jun 3, 2026Pritam Dash, Tongyu Ge, Aditi Jain +2AI Agent Security Benchmarks Agent Memory Poisoning
Huawei Canada · University of Waterloo, Canada · Work done during an internship at Huawei.
MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents
Jul 16, 2026Jifeng Gao, Kang Xia, Yi Zhang +5LLM Agent Memory LLM Agent Security
State Key Laboratory for Novel Software Technology, Nanjing University, China · NARI Group Corporation/State Grid Electric Power Research Institute, China
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
May 14, 2026Sidharth Pulipaka, Stanislau Hlebik, Leonidas Raghav +4Persistent Memory for Language Models LLM Security
1SPAR · 2ELLIS Institute Tübingen, MPI for Intelligent Systems, Tübingen AI Center · 3APTA +1

Jun 3, 2026J/K move · Enter open · S save

From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents

Pritam Dash, Tongyu Ge, Aditi Jain, Tanmay Shah+1

Huawei Canada · University of Waterloo, Canada · Work done during an internship at Huawei.

AI Agent Security Benchmarks Agent Memory Poisoning Memory-Augmented Language Model Agents

Open paper AskPDF arXiv

Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance. However, persistent memory introduces the risk of memory poisoning, where a single adversarial memory write can exert long-term influence over agent behavior. We present a systematic study of memory poisoning in LLM-based agents. We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture that make these channels exploitable. Based on these vulnerabilities, we develop a taxonomy of six classes of memory poisoning attacks. Furthermore, we design MPBench -- a benchmark for evaluating memory poisoning attacks, and show that agents designed to write and retrieve memory more aggressively are more exploitable. We also show that existing prompt injection defenses fail to cover memory poisoning attacks. Our findings provide a foundation for understanding and mitigating memory poisoning attacks against AI agents.

Abstract

LLM Agent Security

Explore similar work

From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents

MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents