Newest papers

After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents

Zhiyue Xu, Xukai Wang, Zhiyuan Huang, Mingjie Zhan, Jian Zhao, Xu-Yao Zhang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28425 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

現代のLLMエージェントは、2つのチャンネルを通じてステータスを継続します: システムプロンプトに静かに預けられた長期記憶ファイルと、ユーザの入力なしでエージェントを起こす予定されたタスク。 1 回の間接プロンプトインジェクションは、攻撃者が去った後、セッションを通して再発射することができ、脅威は携帯攻撃と呼ばれます。既存のプロンプトインジェクションベンチャーは、悪意のあるコンテンツが最初に観察されるセッションで攻撃を評価し、ゲートを支配し、いつ、どのくらいの頻度で植えられたパイロット負荷がその後測定されないように再燃します。 CarryoverBench: 12 個人支援シナリオと、3つのチャンネル

Machine translation (Meta M2M100); the English original follows.

Abstract

Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input. A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves, threats we term carryover attacks. Existing prompt-injection benchmarks evaluate attacks only in the session where malicious content is first observed, leaving the gate governing when and how often a planted payload later re-fires unmeasured. We present CarryoverBench: 12 personal-assistant scenarios and 101 attack tasks across three trigger channels: Instant, same-turn IPI; Autonomous, heartbeat-scheduled; and Latent, memory-resurfaced. A rule-based verifier scores planting and triggering as independent stages. Across five frontier models, planted payloads re-fire without measurable decay over five rounds; conditional on successful planting, the trigger stage often provides little additional protection. Porting the Latent channel to a second runtime, Hermes, attenuates but does not eliminate the effect, suggesting that carryover defense requires runtime-layer controls in addition to prompt-level interventions.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Session (web analytics), Computer science, Computer security, Payload (computing), Porting, State (computer science)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange