Attack Context

Memory Research

Attacks targeting persistent memory and cross-session agent state

5 matching entries out of 11 in this category

Memory research results

5 entries

Context privilege escalation in AI agent harnesses

Published Sep 1, 2026Analyzed Sep 9, 2026Source: arXiv

Context assembly can promote repository, tool or skill content into higher-priority instructions or persistent state. The paper studies 12 pinned agent-harness versions.

What's in Your Agent's Context? Context Privilege Escalation Attacks against AI Agent Harness

Evaluated models: GPT-5.5, GPT-5.4-mini, Claude Sonnet 4.6+4 more

GPT-5.5
GPT-5.4-mini
Claude Sonnet 4.6
Claude Opus 4.6
Gemini 2.5 Flash
Gemini 2.5 Pro
DeepSeek V4 Flash

Single-interaction poisoning of agent memory

Published Aug 24, 2026Analyzed Sep 9, 2026Source: arXiv

A stored interaction can later steer a memory-augmented agent's answer without direct memory-store access. The study evaluates persistent response manipulation in MemoryOS and MemGPT.

InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

Evaluated models: Qwen 2.5 7B Instruct, Qwen 2.5 1.5B Instruct, Qwen 2.5 3B Instruct+3 more

Qwen 2.5 7B Instruct
Qwen 2.5 1.5B Instruct
Qwen 2.5 3B Instruct
Qwen 2.5 14B Instruct
Llama 3.1 8B Instruct
Mistral 7B Instruct v0.3

Persistent Agent Memory Poisoning and Incomplete Repair

Published Jul 29, 2026Analyzed Aug 13, 2026Source: arXiv

MemSecBench follows malicious agent-memory content from initial write through persistence, retrieval, action selection, execution, and attempted selective repair. Its controlled Write–Execute–Forget protocol evaluates 310 human-reviewed cases across two harnesses, four memory backends, three model backends, and seven evidence-gated lifecycle checkpoints.

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Evaluated models: GPT-5.5, DeepSeek V4-Pro, MiniMax-M3

Workspace Agent Runtime Safety Failures Across Risk Carriers

Published Jul 29, 2026Analyzed Aug 13, 2026Source: arXiv

AgentS4D measures unsafe actions and state changes across complete workspace-agent executions rather than treating task completion or isolated model responses as safety evidence. Its 328 sandboxed cases introduce risky content through user requests, documents, web resources, tools, third-party skills, and persistent memory, then compare the same cases across four agent harnesses and five model backends.

AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents

Evaluated models: GPT-5.5, Gemini 3.1 Pro, DeepSeek V4-Pro+2 more

GPT-5.5
Gemini 3.1 Pro
DeepSeek V4-Pro
MiniMax-M3
Qwen3.7-Plus

Long-Context Enterprise Agent Policy Adherence Failures

Published Jul 28, 2026Analyzed Aug 13, 2026Source: arXiv

HANDBOOK.md measures whether an agent can apply detailed organizational rules while completing realistic, multi-step enterprise tasks. The vendor-authored benchmark includes 65 resettable MCP-backed workflows, policy documents of 20 to 124 pages, and 824 deterministic rubric checks covering required decisions, prohibited actions, and final environment state.

HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following

Evaluated models: Claude Fable 5, GPT-5.6 Sol, Claude Opus 4.8+16 more

Claude Fable 5
GPT-5.6 Sol
Claude Opus 4.8
GPT-5.5
Grok 4.5
Muse Spark 1.1
GLM 5.2
Kimi K3
Gemini 3.5 Flash
Claude Sonnet 4.6
Gemini 3.1 Pro
DeepSeek V4-Pro
Qwen 3.7 Max
DeepSeek V4 Flash
Kimi-K2.6
Gemini 3.6 Flash
Gemini 3.5 Flash-Lite
Grok 4.3
Nemotron 3 Ultra

Related research categories