Persistent Agent Weaponization

• Persistent agent weaponization is defined as an attack where adversarial payloads are embedded into an AI agent’s persistent memory, surviving session boundaries to later trigger unauthorized actions.
• The attack methodology often consists of a two-phase process—initial infection through benign inputs and a delayed trigger phase exploiting memory retrieval mechanisms such as sliding-window and RAG techniques.
• Effective defenses require memory-layer controls, write-time authentication, and lifecycle security measures to prevent backdoor implantations and manage state integrity across multi-session architectures.

Persistent agent weaponization denotes a class of attacks on LLM agents and autonomous AI agents in which adversarial inputs—introduced via indirect means such as web content, user interaction, tool outputs, or environment—are written into long-term memory or persistent state, survive across session boundaries, and subsequently trigger unauthorized or harmful actions often well after the initial contaminant has been delivered. The core risk emerges from the self-evolving, memory-augmented, and cross-session architectures adopted by state-of-the-art autonomous agents, where persistent state is leveraged for personalization, long-horizon reasoning, and seamless tool integration. Attackers exploit this persistence to implant backdoors, stealth trojans, or control logic that, once present in the agent’s memory or configuration, become part of the trusted computing base, often bypassing session-bound guardrails and output-level safety checks.

1. Attack Models and Threat Formalization

Formal models of persistent agent weaponization distinguish between stateless, session-confined attacks and those leveraging multi-session state evolution. In the canonical “Zombie Agent” paradigm, an agent’s state at session $j$ is $S_j = (\theta, M_j)$, with $\theta$ the model backbone and $M_j$ the long-term memory (Yang et al., 17 Feb 2026). The attacker’s objective is to inject a payload $Z$ such that $Z \in M_{j+1}$ post-infection, and for all $k > j$, $P_{\text{persist}}(k) = \Pr[Z \in M_k] \approx 1$. Later, a trigger event retrieves $m_k \subseteq M_k$, producing an unauthorized tool invocation $a_{\text{unauth}}$ via a function $S_j = (\theta, M_j)$0.

Other formalizations include modeling stateful backdoors as a Mealy machine $S_j = (\theta, M_j)$1, in which each session transition corresponds to an independent sub-backdoor (Dai et al., 7 May 2026). Adversaries can realize multi-phase attacks: initial infection, dormant memory persistence, and session-delayed actuation.

Key adversarial capabilities include:

• Indirect injection via observation (e.g., environmental or web-content poisoning (Zou et al., 3 Apr 2026))
• Only black-box access to agent, with no direct file or parameter modification
• Ability to optimize triggers for retrievability under diverse memory schemas (e.g., sliding-window, RAG, graph-structured)

2. Weaponization Mechanisms and Attack Strategies

Persistent weaponization exploits structural features of agent memory architectures. Attacks are typically stratified into phases:

Phase I – Infection:

• Agent processes benign-appearing content, e.g., via read_url or environmental observation.
• Adversarial snippet is embedded in this content, inserted into the session context, and persists via the agent’s standard memory update process (Yang et al., 17 Feb 2026, Zou et al., 3 Apr 2026).

Phase II – Trigger:

• In unrelated downstream sessions, the agent’s retrieval mechanism surfaces the malicious memory, even semantically distant from the original task.
• Engineered triggers (semantic aliases, entity masquerading, graph-based triggers) guarantee recall by exploiting embedding space structure or memory extraction routines (Wang et al., 28 May 2026, Zhang et al., 9 Jun 2026).

Attackers employ persistence strategies tailored to major memory architectures:

• Sliding-Window (FIFO) Persistence: Recursive self-reinsertion of payload ($S_j = (\theta, M_j)$2) avoids eviction by instructing the agent to re-read or self-copy $S_j = (\theta, M_j)$3 on every reasoning step.
• Retrieval-Augmented Generation (RAG): Adversaries create broad embedding “pollution” with semantic aliasing and multiple paraphrased copies of $S_j = (\theta, M_j)$4, ensuring high recall probability for most queries (Yang et al., 17 Feb 2026).
• Graph-Structured or Multimodal Memories: Multimodal adversarial payloads couple visual triggers and OCR-injected text, forming modular subgraphs recalled by visual triggers (Zhang et al., 9 Jun 2026).
• Stateful Backdoors: Attack logic is fragmented across session-bound states, encoded in tool-accessible keys or notes, and progresses pairs of $S_j = (\theta, M_j)$5 over multiple sessions (Dai et al., 7 May 2026).

3. Empirical Results and Effects

Experimental evaluations consistently demonstrate high attack success rates (ASR) in diverse agent systems:

Attack Type / System	Attack Success Rate (ASR)	Key Metrics
Zombie Agent (RAG)	ASR ≈ 85–90% over 20 trigger rounds	Persistence, Recall@K
Environment-injected Poisoning	Up to 32.5% (GPT-5-mini), 23.4% (GPT-5.2) (Zou et al., 3 Apr 2026)	Frustration Exploitation
MemPoison (Selective Memory)	ASR up to 0.95 (Wang et al., 28 May 2026)	ISR, RSR, ACC
MemVenom (Multimodal)	End-to-end ASR up to 99.15% (GPT-5.4, ReAct) (Zhang et al., 9 Jun 2026)	ASR-r, ASR-a, Persistence
Stateful Backdoor	ASR 80–95% (Primary/Branch/Note) (Dai et al., 7 May 2026)	Per-transition ASR
Real-world CIK poisoning	Post-poisoning ASR: C=57.7-88.5%, K=44.2–89.2% (OpenClaw) (Wang et al., 6 Apr 2026)	12 real-world harms

Notably, attacks maintain benign task performance (ΔU ≈ 0 or ACC ≈ 0.87–0.96) in most settings, evading utility-loss detection (Yang et al., 17 Feb 2026, Wang et al., 28 May 2026). Control and propagation are shown even in cross-platform agent worm deployments, including zero-click, multi-hop, and cross-agent cases (Zha et al., 4 May 2026, Zhang et al., 16 Mar 2026).

Routine conversation itself, without any explicit adversarial payload, leads to significant state drift (authorization, tool-use, autonomy) nearly matching explicit attack baselines, as quantified by the Harm Score metric (Xu et al., 7 May 2026).

4. Defense Limitations and Mitigation Architectures

Conventional defenses—per-session prompt sanitization, one-step output guardrails, instruction-level filters—are ineffective against persistent attacks (Yang et al., 17 Feb 2026, Zou et al., 3 Apr 2026, Tan et al., 29 May 2026). Attackers defeat output-level defenses by hiding payloads in persistent memory, exploiting semantic rewriting and context filtering.

Effective defense must operate at the memory and state boundary:

• Memory-layer Controls: Policy-driven memory sanitization, provenance tagging, schema enforcement for instruction/data separation, and source labeling are required to block unauthorized memory writes and quarantine or remove suspect entries (Yang et al., 17 Feb 2026, Tan et al., 29 May 2026).
• Write-Time Authentication: HMAC-SHA256 or similar cryptographic signatures on memory entries prevent unsigned injection; randomized ablation and verdict-based aggregation at retrieval further limit authenticated adversary effectiveness with formal robustness certificates (Sharma, 10 Jun 2026).
• Persistence Gatekeeping: Complete mediation mechanisms, e.g., provenance gates enforcing “only owner-trusted” provenance or one-shot attestations, guarantee that cross-session, cross-context memory cannot trigger harmful actions without explicit approval (Maloyan et al., 13 May 2026).
• Systemic OS- and Framework-level Boundaries: File and capability isolation, sandboxing of skills, net/FS egress proxies, and orchestrator-authenticated APIs minimize the attack blast radius and prevent persistent file-based footholds (Pasquini et al., 23 Jun 2026, Wang et al., 6 Apr 2026).
• Lifecyle Defense-in-Depth: Multi-layer architectures (e.g., AgentWard) coordinate controls across initialization, input, memory, decision, and execution stages, using monotonically decreasing trust scores and cross-stage propagation of risk signals (Zhang et al., 27 Apr 2026).

Defensive architectures must reconcile evolution–safety trade-offs: file protection can block ≫90% of attacks, but often freezes agent evolution by denying legitimate updates (Wang et al., 6 Apr 2026). Lightweight, high-recall LLM-based auditors (e.g., StateGuard) can reduce state-poisoning-induced harm scores to near zero but at the cost of non-trivial false positives (≈50–60%) (Xu et al., 7 May 2026).

5. Implications for Agent Design and Ecosystem Security

Persistent agent weaponization is a structural problem arising from the convergence of memory evolution, authority convergence (agent runs as owner), and flat trust boundaries (e.g., context >= system prompt) (Zhang et al., 16 Mar 2026, Maloyan et al., 13 May 2026). Attack propagation is amplified in ecosystem settings—multi-agent deployments, cooperative toolchains, agent-operated software supply chains—where contaminated content can spread without further attacker intervention.

Research confirms that “capability ≠ security”: higher-capability models (e.g., GPT-5.2) exhibit higher attack compliance, especially under environmental stress, due to better long-context recall and willingness to follow retrieved in-memory directives (Zou et al., 3 Apr 2026, Wang et al., 28 May 2026). Multi-session, memory-mediated control surfaces are the predominant attack path, eclipsing stateless prompt injection in practical danger.

Strategy recommendations include:

• Cryptographic integrity and provenance on all persistent artifacts
• Lifecycle and cross-layer security with invariant propagation
• Fine-grained permission and isolation policies anchored outside the LLM loop
• Continuous audit of memory and behavioral baselines for anomalous state transition sequences
• Trust labeling and explicit human approval gating irreversible or out-of-band actions

6. Open Challenges, Research Directions, and Limitations

Persistent weaponization remains an open, dynamic threat. Current limitations of defenses include:

• Adaptive adversarial strategies (paraphrase laundering, fragmented payloads, semantic mimicry) defeating string- or embedding-based detection (Maloyan et al., 13 May 2026, Tan et al., 29 May 2026).
• High operational cost of deterministic file protection or high-recall LLM diff auditing in practical deployments (Wang et al., 6 Apr 2026, Xu et al., 7 May 2026).
• Incomplete coverage for side-channel, fine-tuning, or cross-session propagation not easily mediated by execution-time controls (Zhang et al., 27 Apr 2026).
• Dependence on instrumented harnesses and annotated provenance for real-time defense; closed-source or legacy deployments may lack necessary mediation hooks (Tan et al., 29 May 2026).

Future work targets formal verification of containment invariants, adaptive threshold tuning via red-teaming, multi-agent coordination security protocols, and generalization of provenance-randomization defense patterns across agent frameworks (Zhang et al., 27 Apr 2026, Sharma, 10 Jun 2026).

7. Summary Table of Attack Techniques and Defenses

Class of Attack	Example Mechanisms	Effective Defense Layers	Notable Limitations
Indirect Memory Poisoning	Environmental, web, or tool content	Memory admission/policy, provenance	Embedding pollution resists heuristics
Multi-Step Trojan / Zombie Agent	Recursive self-reinforcement, RAG pollution	Memory-layer provenance, recall filters	Requires full state mediation
Stateful/Mealy Machine Backdoor	Cross-session state, note tools	Fine-grained mem audit, sequence analysis	Requires per-transition coordination
Multimodal Recall/Graph Poisoning	Triggered retrieval, OCR injection	Typed memory separation, OCR & patch checks	Multimodal cues evade simple filters
Ecosystem Worm/Autonomous Propagation	Config hijack, cross-agent message	Temporal re-entry blocking, config sealing	Requires ecosystem-wide consistency
Routine Interaction State Drift	Unintended memory edit drift	Writeback auditing, LLM diff inspection	High false-positive if safety-first

These represent only a fraction of the vectors and countermeasures documented across recent arXiv literature (Yang et al., 17 Feb 2026, Zou et al., 3 Apr 2026, Wang et al., 6 Apr 2026, Dai et al., 7 May 2026, Tan et al., 29 May 2026, Zhang et al., 9 Jun 2026, Maloyan et al., 13 May 2026, Zhang et al., 27 Apr 2026, Sharma, 10 Jun 2026, Wang et al., 28 May 2026, Zhang et al., 16 Mar 2026, Pasquini et al., 23 Jun 2026, Xu et al., 7 May 2026).

• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections (Yang et al., 17 Feb 2026)
• Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents (Zou et al., 3 Apr 2026)
• Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw (Wang et al., 6 Apr 2026)
• When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agents (Xu et al., 7 May 2026)
• From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors (Tan et al., 29 May 2026)
• Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense (Zha et al., 4 May 2026)
• ClawWorm: Self-Propagating Attacks Across LLM Agent Ecosystems (Zhang et al., 16 Mar 2026)
• Red-Teaming the Agentic Red-Team (Pasquini et al., 23 Jun 2026)
• SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems (Sharma, 10 Jun 2026)
• Sleeper Channels and Provenance Gates: Persistent Prompt Injection in Always-on Autonomous AI Agents (Maloyan et al., 13 May 2026)
• Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction (Wang et al., 28 May 2026)
• MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents (Zhang et al., 9 Jun 2026)
• AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents (Zhang et al., 27 Apr 2026)
• Stateful Agent Backdoor (Dai et al., 7 May 2026)