Newest papers

After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents

Zhiyue Xu, Xukai Wang, Zhiyuan Huang, Mingjie Zhan, Jian Zhao, Xu-Yao Zhang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28425 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Los agentes LLM modernos persisten en estado a través de dos canales: archivos de memoria de larga duración silenciosamente prependidos al prompt del sistema, y tareas programadas que despiertan al agente sin la entrada del usuario. Una inyección de prompt indirecta de una vez en cada uno de los canales puede reiniciar el fuego a través de las sesiones mucho después de que el atacante abandone, las amenazas que definimos como ataques de cargamento. Los parámetros de referencia de la inyección de prompt existentes evalúan los ataques sólo en la sesión en la que se observa por primera vez el contenido malicioso, dejando la puerta gobernando cuándo y con qué frecuencia una carga útil plantada se reinicia sin medida. Presentamos CarryoverBench: 12 escenarios de asistencia personal y 101 tareas

Machine translation (Meta M2M100); the English original follows.

Abstract

Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input. A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves, threats we term carryover attacks. Existing prompt-injection benchmarks evaluate attacks only in the session where malicious content is first observed, leaving the gate governing when and how often a planted payload later re-fires unmeasured. We present CarryoverBench: 12 personal-assistant scenarios and 101 attack tasks across three trigger channels: Instant, same-turn IPI; Autonomous, heartbeat-scheduled; and Latent, memory-resurfaced. A rule-based verifier scores planting and triggering as independent stages. Across five frontier models, planted payloads re-fire without measurable decay over five rounds; conditional on successful planting, the trigger stage often provides little additional protection. Porting the Latent channel to a second runtime, Hermes, attenuates but does not eliminate the effect, suggesting that carryover defense requires runtime-layer controls in addition to prompt-level interventions.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Session (web analytics), Computer science, Computer security, Payload (computing), Porting, State (computer science)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange