Summary
A new arXiv paper describes carryover attacks, a threat in which a one-time indirect prompt injection is stored in an LLM agent's persistent state and triggers again in later sessions. According to the snippet, agents keep state through long-lived memory files that are silently prepended to the system prompt, and through scheduled tasks that wake the agent without user input. The authors say these attacks can continue to act long after the attacker has left. The snippet also notes that existing prompt-injection benchmarks evaluate attacks only within a single session, which the paper is designed to address.
AI-assisted summary based on the listed source.
What happened
Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input. A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves,...
Why it matters
Developers building agents with memory or scheduled tasks may need to treat stored memory and recurring triggers as possible attack paths, not just the current conversation. Security teams deploying such agents could look for ways to test persistence across sessions. The paper's benchmark is the item to watch, since it may offer a shared way to measure these risks.
Signal Intelligence
Signal Strength 95%
Technical label SOURCE-BACKED
Public Interest 34
Category SECURITY
Reader Depth TECHNICAL
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
Public Interest components
Recognizable Entity Score 0
Practical Impact Score 8
Novelty Interest Score 94
Consequence Score 46
Curiosity Score 16
Shareability Score 46
