Updated 7/20/2026
The paper describes and evaluates a reproducible application-layer weakness in agents with persistent memory: untrusted external content can cross the memory-write boundary, be stored as trusted factual, experience, or procedural memory, and influence later sessions. It identifies four write channels—explicit writes, policy-driven writes, compaction, and experience-to-procedure synthesis—and six attack classes. For safe defensive testing, use MPBench’s two-phase structure in an isolated agent…
From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
Affects: GPT-oss 120B
Source: arXiv