Newest papers

After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents

Zhiyue Xu, Xukai Wang, Zhiyuan Huang, Mingjie Zhan, Jian Zhao, Xu-Yao Zhang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28425 · cited by 0 works (OpenAlex) · open-access PDF

Korean

현대 LLM 에이전트는 두 채널을 통해 세션에 걸쳐 상태를 유지합니다 : 오래된 메모리 파일은 시스템 프롬프트에 조용히 전달되며 일정한 작업은 사용자 입력없이 에이전트를 깨우고 있습니다. 한 번의 간접 프롬프트 주입은 공격자가 떠난 후 세션을 통해 다시 화재 할 수 있습니다. 위협은 전송 공격을 말합니다. 기존의 프롬프트 주입 벤치마크는 악성 콘텐츠가 처음 관찰되는 세션에서만 공격을 평가하며 게이트가 언제 그리고 얼마나 자주 정착 된 유용 부하가 나중에 측정되지 않은 상태로 다시 화재 할 수 있습니다. CarryoverBench: 12 개의 개인 지원 시나리오와 3 개의 트리거 채널에 걸친 101 개의 공격 작업: 즉

Machine translation (Meta M2M100); the English original follows.

Abstract

Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input. A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves, threats we term carryover attacks. Existing prompt-injection benchmarks evaluate attacks only in the session where malicious content is first observed, leaving the gate governing when and how often a planted payload later re-fires unmeasured. We present CarryoverBench: 12 personal-assistant scenarios and 101 attack tasks across three trigger channels: Instant, same-turn IPI; Autonomous, heartbeat-scheduled; and Latent, memory-resurfaced. A rule-based verifier scores planting and triggering as independent stages. Across five frontier models, planted payloads re-fire without measurable decay over five rounds; conditional on successful planting, the trigger stage often provides little additional protection. Porting the Latent channel to a second runtime, Hermes, attenuates but does not eliminate the effect, suggesting that carryover defense requires runtime-layer controls in addition to prompt-level interventions.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Session (web analytics), Computer science, Computer security, Payload (computing), Porting, State (computer science)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange