Observation Poisons Agent Memory
Published Analyzed Source: arXiv
Memory-augmented LLM web agents utilizing raw trajectory memory are vulnerable to Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP). Attackers can embed malicious instructions within user-generated web content (e.g., product pages, forum posts). When the agent processes this content during a routine task, the instructions are passively ingested into its raw trajectory memory. During subsequent, entirely separate tasks on different websites, semantic retrieval mechanisms pull…
Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents
Evaluated models: GPT-5 Mini, GPT-5.2, GPT-oss 120B+3 more
- GPT-5 Mini
- GPT-5.2
- GPT-oss 120B
- Qwen 2.5 VL 72B
- Qwen3-VL-32B
- Qwen3.5-122B-A10B