Agent Memory Poisoning

Follow this topic Ask about this topic

Agent memory poisoning examines how misleading or malicious information enters an AI agent’s persistent memory and shapes behavior across later tasks or sessions. Attacks can exploit external content, memory updates, retrieval, consolidation, multimodal inputs, or sharing between agents, sometimes steering tool use long after the original exposure. Defenses include provenance tracking, source-trust limits, write-time anomaly checks, retrieval-time controls, cryptographic lineage, and selective auditing or rollback; benchmarks increasingly test persistence, downstream effects, and repair. A central challenge is distinguishing harmful content from useful but untrusted evidence: static filters can miss attacks assembled across records or activated by context, while stricter controls can block legitimate learning and adaptation.

Latest papers

79 papers12 papers in the last four weeks, up 140% on the four weeks before. 0.1% of all new papers.

Is it my preference? Role Grounding Attack against Agent's Memory via Social Interaction
Oct 28, 2026Haoran Bu, Yiting Shen, Litian Zhang +2AI Agent Security LLM Agent Safety
Beijing University of Posts and Telecommunications, Beijing, China
PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust
Oct 20, 2026Tanqiu Jiang, Min Bai, Sadat Shahriar +2LLM Agent Memory AI Agent Security
Stony Brook University · AWS AI Labs
After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
Oct 20, 2026Zhiyue Xu, Xukai Wang, Zhiyuan Huang +3Adversarial Attacks on LLMs Prompt Injection Attacks on AI Agents
MAIS, Institute of Automation, Chinese Academy of Sciences · School of Artiﬁcial Intelligence, UCAS · Zhongguancun Academy +2
ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents
Oct 20, 2026Jinhao Hu, Bardia Mohammadi, Mofasshara Binte Rafique +4AI Agent Security Memory Management for LLM Agents
MPI-SWS · Unaffiliated · EPFL +2
AutoRedClaw: Automated Red-Teaming for Claw-Style Agents
Oct 19, 2026Hao Li, Tongyan Hu, Weidi Luo +8AI Agent Security Automated Red Teaming
Washington University in St. Louis · Johns Hopkins University · National University of Singapore +3
SAFE-Mem: Secure Agentic Memory with Fine-Grained Authority and Governance-Aware Retrieval
Oct 16, 2026Haoming Li, Dingyi Kang, Xu Hu +8Persistent Memory for Language Models Agent Memory Poisoning
The University of Texas at Dallas · Emory University · Virginia Tech +3
MemForm: Benchmarking Memory Formation Poisoning in LLM Agents
Oct 10, 2026Haowen Pan, Pengyang Shao, Yunshan Ma +4Agent Memory Poisoning Persistent Memory for Language Models
University of Science and Technology of China · National University of Singapore · Singapore Management University
Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agents
Oct 9, 2026Lei Liu, Yunji Liang, Xiaowen Zhang +4Agent Memory Poisoning Backdoor Defense in LLMs
Northwestern Polytechnical University · National Univerisity of Singapore
SkillPoison: Progressive Skill Poisoning via Successful Experiences
Oct 6, 2026Lizhi Zhang, Xin He, Dianxuan Fu +5Adversarial Attacks LLM Agent Safety
Jilin University · The Hong Kong Polytechnic University
Self-Propagating Misalignment in LLM Agents, and Why Auditing or Disabling Memory Is Not Enough
Oct 2, 2026Debeshee Das, Jacqueline Tay, Bruce Tsai +2LLM Agent Safety AI Alignment
Anthropic Fellows Program · Independent · Constellation Institute +1
VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agents
Sep 29, 2026Yurong Hao, Wen Zhou, Guowei Guan +3Adversarial Attacks Agent Memory Poisoning
College of Computing and Data Science, Nanyang Technological University
Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents
Sep 28, 2026Sidharth Pulipaka, Ansh Sharma, Stanislau Hlebik +4AI Agent Security Agent Memory Poisoning
SPAR · University of Cambridge · APTA AI +1
From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agents
Sep 28, 2026Mingxi Zou, Langzhang Liang, Zhuo Wang +3Adversarial Attacks Agent Memory Poisoning
Shanghai Academy of AI for Science (SAIS) · Fudan University · Monash University
A Benchmark and Diagnostic Study of Epistemic Admission in Shared Agent Memory
Sep 25, 2026Xiaoyang Li, Yiqi Wang, Chencheng Zhu +6Memory Agent Benchmarks Agent Memory Management
University of Southern Queensland · University of New South Wales · Aikaier +2
The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents
Sep 19, 2026Pritom BhowmikLLM Agent Safety Memory-Augmented Language Model Agents
Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems
Sep 15, 2026Deepak Akkil, Tamer Abuelsaad, Karthik Vikram +5Multi-Agent LLM Systems Long-Horizon Agent Evaluation
Emergence AI
When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents
Sep 12, 2026Shuhuai Huang, Jingfeng Zhang, Hong JiaLLM Agent Security Agent Memory Poisoning
University of Auckland · Fudan University
CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents
Sep 2, 2026S M Asif Hossain, Ruksat Khan Shayoni, Md Kishor MorolAgent Memory Poisoning LLM Agents
InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
Aug 24, 2026Hanling Tian, Gengyu Zhang, Zeyang Sha +5LLM Agent Memory Prompt Injection Attacks on AI Agents
Institute of Image Processing and Pattern Recognition, Shanghai Jiao Tong University · Ant Group
MEMORY Wins All: Indirect Bias Injection Attacks via Social Media Feeds
Aug 22, 2026Minjae Seo, Wonwoo Choi, Geonwoo Han +7AI Agent Security Agent Memory Poisoning
ETRI · Seoul National University · ADD +1
Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking
Aug 21, 2026Arulnidhi KarunanidhiAgent Memory Poisoning Retrieval Robustness
Quantify Labs Ltd
GraphWake: Group Polarization via Memory-Mediated Polarization Cascade in LLM-Agent Communities
Aug 18, 2026Haoran Bu, Zejian Chen, Litian Zhang +1AI Agent Security Multi-Agent LLM Systems
Key Laboratory of Trustworthy Distributed Computing and Service (MoE), Beijing University of Posts and Telecommunications, China
From Faulty Memories to Corrected Actions: Dependency-Guided Rollback Repair for Memory-Augmented Agents
Aug 11, 2026Yiqi Wang, Caili Yu, Jiaqi Zhang +5Agent Memory Poisoning Agent Memory Management
Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario
Aug 8, 2026Satoshi MatsuokaLLM Agent Security Agent Memory Poisoning
RIKEN Center for Computational Science, Kobe, Japan
Persistent Semantic Entities in Tool-Augmented LLM Systems
Aug 8, 2026Zhaohui WangAgent Memory Tool-Augmented Language Model Agents
USC Viterbi School of Engineering, University of Southern California, Los Angeles, CA, USA.
Controlled Memory Interference in Continual LLM Agents
Aug 7, 2026Ao Ding, Hongzong LI, Shiqin Tang +4Continual Learning for LLM Agents Agent Memory Poisoning
China University of Geosciences (Beijing) · Northwestern Polytechnical University · The Hong Kong University of Science and Technology +4
MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents
Aug 4, 2026Jiaming Chen, Yisen Gao, Yanping Li +3Agent Memory Poisoning Memory-Augmented Language Model Agents
The Hong Kong University of Science and Technology · Hong Kong SAR, China
MutMem: Cryptographically Authorized Mutation in Persistent Agent Memory
Aug 3, 2026Walid SaidiLLM Agent Memory Agent Memory Poisoning
Independent researcher
Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw
Aug 3, 2026Zheng Lin, Yuzhe Huang, Zhenxing Niu +2Agent Memory Poisoning Automated Red Teaming
Xidian University Xi’an, Shaanxi, China
MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems
Aug 1, 2026Wenjun Xiong, Yijin Zhou, Jiaqian Wang +6Multi-Agent LLM Systems Agent Memory Poisoning
Shanghai Jiao Tong University · Shanghai Innovation Institute · Xidian University +2

Oct 28, 2026J/K move · Enter open · S save

Is it my preference? Role Grounding Attack against Agent's Memory via Social Interaction

Haoran Bu, Yiting Shen, Litian Zhang, Ruihan Hu+1

Beijing University of Posts and Telecommunications, Beijing, China

AI Agent Security LLM Agent Safety Agent Memory Poisoning Privacy Leakage in Language Models

Open paper AskPDF arXiv

LLM-based agents now share experiences on social platforms and remember new preferences to enhance their performance. However, existing memory systems contain a vulnerability in role-to-principal attribution that attackers can exploit. We identify Role Grounding Misattribution, in which an attacker-designed interaction causes the victim agent to incorrectly record a preference from the attacker as a preference of the victim's user. Specifically, we are the first to formalize Role Grounding Attack (RGA), an attack model that exploits this vulnerability through nested conversation structures. In the memory formation stage, an experience-sharing post quoting a conversation between the attacker agent and its user is published, which explicitly identifies its publisher. The inner conversation expresses preferences from the user of the attacker agent. When the victim agent remembers preferences from this nested structure, its memory loses the context binding and grounds the attacker's preference to the victim's user instead. In the memory retrieval stage, the misattributed preference persists and influences the victim agent's decisions when it encounters relevant scenarios. We instantiate RGA as tool selection manipulation and privacy leakage. Tool selection manipulation causes a tool-call preference to be misattributed to the victim's user, steering the victim toward an attacker-controlled tool. Privacy leakage extends this by misattributing both a tool-call preference and a task-requirement preference to the victim's user. The victim selects the attacker's tool, then includes sensitive information in tool arguments to satisfy the task requirement. We evaluate RGA across five mainstream memory systems and six language models. Tool manipulation and privacy leakage both achieve high attack success rates. These results call for stronger role grounding.