Updated 7/20/2026
The paper presents a specific black-box indirect prompt-injection evaluation: attacker-controlled external content can cause a memory-enabled assistant or external memory manager to persist a fabricated user memory, which may later be retrieved in a separate session and steer responses or agent actions. The authors evaluate injection, retrieval, and conditional adversarial usage separately across synthetic document and future-session datasets. The released repository provides defensive…
Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
Affects: GPT-5.4, GPT-5.5, Claude Sonnet 4.6 +3 more
Source: arXiv