Persistent Memory Poisoning in LLM Agents

Description

The paper describes and evaluates a reproducible application-layer weakness in agents with persistent memory: untrusted external content can cross the memory-write boundary, be stored as trusted factual, experience, or procedural memory, and influence later sessions. It identifies four write channels—explicit writes, policy-driven writes, compaction, and experience-to-procedure synthesis—and six attack classes. For safe defensive testing, use MPBench’s two-phase structure in an isolated agent with synthetic, harmless directives: provide labeled untrusted context during one task, inspect whether an equivalent entry reaches persistent memory, then issue a separate benign follow-up query and check whether retrieval changes behavior. The reported measurements are the authors’ results, not independently verified facts.

Examples

See the primary source for the paper's evaluation and defensive reproduction context: https://arxiv.org/abs/2606.04329 (opens in a new tab)

Impact

A single untrusted input can persistently alter later agent reasoning or actions without further attacker involvement, causing trust hijacking, unauthorized actions, recommendation manipulation, authentication-policy bypass, or unsafe procedural reuse. The paper reports average ASR/RSR of 34.25%/17.40% for OpenClaw and 66.67%/64.70% for HERMES under its benchmark; these results used GPT-OSS-120B and may not generalize to other models or deployment pipelines.

Affected Systems

• LLM agents with persistent long-term memory
• Agents that infer memory writes from broad retention policies
• Agents that compact conversations into persistent memory
• Agents with autonomous skill or procedural-memory creation
• OpenClaw
• HERMES

Mitigation Steps

• Enforce precise, scope-limited memory-write policies that define authorized content and reject untrusted behavioral directives.
• Validate every write before persistence, especially factual, experience, and procedural-memory updates.
• Preserve provenance and isolate trusted user instructions from webpages, documents, email, tool outputs, and other external content.
• Apply source-aware retrieval policies that demote, quarantine, or require confirmation for memories originating from untrusted sources.
• Filter compaction inputs by trust level so untrusted content is not silently promoted into persistent memory.
• Require inspection or approval before creating or updating reusable skills and procedural memory.
• Monitor stored entries before retrieval or action against the agent’s authorized storage, action, and endpoint policies.
• Do not rely solely on prompt-injection detectors; evaluate memory poisoning at both write and retrieval stages.

Evidence

• Primary source abstract and §1: https://arxiv.org/abs/2606.04329 (opens in a new tab) reports four memory-write channels, nine structural vulnerabilities, six attack classes, MPBench, and incomplete coverage by prompt-injection defenses.
• Primary source §2.2–§2.3: https://arxiv.org/html/2606.04329 (opens in a new tab) defines explicit, policy-driven, compaction-driven, and experience-to-procedure writes, plus missing source attribution, vague write policies, absent write-path validation, shared contexts, and unvalidated skill creation.
• Primary source §3.1–§3.2: https://arxiv.org/html/2606.04329 (opens in a new tab) defines a black-box attacker using normal external inputs and classifies six memory-poisoning attacks; successful poisoning requires a write and later retrieval that affects behavior.
• Primary source §4.1: https://arxiv.org/html/2606.04329 (opens in a new tab) describes MPBench's reproducible two-phase evaluation: 3,240 adversarial and 2,997 benign cases across seven domains, memory-store inspection after the first session, and a separate retrieval session.
• Primary source Table 2 and §4.2–§4.4: https://arxiv.org/html/2606.04329 (opens in a new tab) reports OpenClaw average ASR/RSR of 34.25%/17.40% and HERMES 66.67%/64.70%, with all experiments using GPT-OSS-120B; these are paper-reported measurements only.
• Primary source §4.5 and Tables 3–4: https://arxiv.org/html/2606.04329 (opens in a new tab) reports incomplete prompt-injection-defense coverage, including weaker detection of weak-signal attacks.
• Primary source §5: https://arxiv.org/html/2606.04329 (opens in a new tab) recommends write-path defenses: tighter policies, source isolation, provenance tracking, source-aware retrieval, compaction filtering, and post-write monitoring.
• Primary source Limitations: https://arxiv.org/html/2606.04329 (opens in a new tab) states the evaluation used only GPT-OSS-120B and that several domains used labeled context blocks rather than modeling a real tool-retrieval pipeline.