mlsanityData to 7 Oct 2026

From Storage to Steering: Memory Control Flow Attacks on LLM Agents

arXiv 2603.15125 ↗First posted 16 Mar 2026cs.CRcited by 17

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Modern agentic systems allow Large Language Model (LLM) agents to tackle complex tasks through extensive tool usage, forming structured control flows of tool selection and execution. Existing security analyses often treat these control flows as ephemeral, one-off sessions, overlooking the persistent influence of memory. This paper identifies a new threat from Memory Control Flow Attacks (MCFA) that memory can dominate the control flow, forcing unintended tool usage even against explicit user instructions and inducing persistent behavioral deviations across tasks. To understand the impact of this vulnerability, we further design MEMFLOW, an automated evaluation framework that systematically identifies and quantifies MCFA across heterogeneous tasks and long interaction horizons. To evaluate MEMFLOW, we attack state-of-the-art LLMs, including GPT-5 mini, Claude Sonnet 4.5 and Gemini 2.5 Flash on real-world tools from two major LLM agent development frameworks, LangChain and LlamaIndex. The results show that in general over 90% of trials are vulnerable to MCFA even under strict safety constraints, highlighting critical security risks that demand immediate attention.

Key facts. Cited by 17 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 26 of its 32 references that are in the map. First posted on arXiv 16 Mar 2026.

Builds on

26 of 32 references.

Closest ancestors · 14

Same direction, newest first

  1. 2026VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit9 Jan
  2. 2025A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory29 Sep
  3. 2025Attractive Metadata Attack: Inducing LLM Agents to Invoke Malicious Tools4 Aug
  4. 2025Les Dissonances: Cross-Tool Harvesting and Polluting in Pool-of-Tools Empowered LLM Agents4 Apr
  5. 2025Memory Injection Attacks on LLM Agents via Query-Only Interaction5 Mar
  6. 2025Unveiling Privacy Risks in LLM Agent Memory17 Feb
  7. 2024The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents21 Dec
  8. 2024Agent-SafetyBench: Evaluating the Safety of LLM Agents19 Dec
  9. 2024Imprompter: Tricking LLM Agents into Improper Tool Use19 Oct
  10. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
  11. 2024Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification30 Jul
  12. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
2 more
  1. 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar
  2. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar

Other references · 12

  1. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  2. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  4. 2023MemGPT: Towards LLMs as Operating Systemscited by 1,295
  5. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  6. 2024Agent Workflow Memorycited by 342
  7. 2024ReMEmbR: Building and Reasoning Over Long-Horizon Spatio-Temporal Memory for Robot Navigationcited by 67
  8. 2023Misusing Tools in Large Language Models With Visual Adversarial Examplescited by 40
  9. 2024Reducing Tool Hallucination via Reliability Alignmentcited by 37
  10. 2024Attacks on Third-Party APIs of Large Language Modelscited by 14
  11. 2025ToolACE-MT: Non-Autoregressive Generation for Agentic Multi-Turn Interactioncited by 11
  12. 2025Malicious GenAI Chrome Extensions: Unpacking Data Exfiltration and Malicious Behaviourscited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 17.

17 papers.

Sort:

By area:

  1. 2026A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecyclecited by 21
  2. 2026ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watcherscited by 18
  3. 2026Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agentscited by 17
  4. 2026Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guaranteescited by 14
  5. 2026A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Frameworkcited by 9
  6. 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 5
  7. 2026The Y-Combinator for LLMs: Solving Long-Context Rot with λ-Calculuscited by 3
  8. 2026MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agentscited by 3
  9. 2026MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repaircited by 2
  10. 2026When Convenience Becomes Risk: A Semantic View of Under-Specification in Host-Acting Agentscited by 1
  11. 2026When Routine Chats Turn Toxic: Unintended Long-Term State Poisoning in Personalized Agentscited by 1
  12. 2026Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agentscited by 1
5 more
  1. 2026MemVenom: Triggered Poisoning of Multimodal Memories in Web Agentscited by 0
  2. 2026Agent Security Meets Regulatory Reality -- A Practitioner Systematization of Autonomous-Agent Threats and Controls in Regulated Financial Systemscited by 0
  3. 2026RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Controlcited by 0
  4. 2026MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneckcited by 0
  5. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026MemEvoBench: Benchmarking Safety Risks from Memory Misevolution in LLM Agents
  2. 2026From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agents
  3. 2026Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory
  4. 2026On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models
  5. 2026AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management
  6. 2026From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
  7. 2026MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning
  8. 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents