Newest papers

After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents

Zhiyue Xu, Xukai Wang, Zhiyuan Huang, Mingjie Zhan, Jian Zhao, Xu-Yao Zhang · 2026 · arXiv

DOI: 10.48550/arXiv.2610.28425 · open-access PDF

Indonesian

Agen LLM modern bertahan status melalui sesi melalui dua saluran: file memori yang bertahan lama diam-diam diprediksi ke prompt sistem, dan tugas-tugas yang dijadwalkan membangkitkan agen tanpa input pengguna. Injeksi prompt tidak langsung satu kali yang dilakukan ke saluran mana pun dapat meledak kembali melalui sesi lama setelah penyerang meninggalkan, ancaman yang kita sebut serangan carryover. Referensi prompt-injeksi yang ada hanya mengevaluasi serangan di sesi di mana konten berbahaya pertama kali diamati, meninggalkan gerbang yang mengatur kapan dan seberapa sering beban yang ditanam kemudian membakar kembali tanpa pengukuran.

Machine translation (Meta M2M100); the English original follows.

Abstract

Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input. A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves, threats we term carryover attacks. Existing prompt-injection benchmarks evaluate attacks only in the session where malicious content is first observed, leaving the gate governing when and how often a planted payload later re-fires unmeasured. We present CarryoverBench: 12 personal-assis

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange