Sleeper Channels and Provenance Gates: Persistent Prompt Injection in Always-on Autonomous AI Agents
On the map: LLM safety and security → Prompt injection and agent security
Abstract (arXiv)
Always-on AI agents (OpenClaw, Hermes Agent) run as a single persistent process under the owner's identity, folding messaging, memory, self-authored skills, scheduling, and shell into one authority boundary. This configuration opens what we call sleeper channels: an untrusted input to one surface persists as a memory, skill, scheduled job, or filesystem patch, then fires later through a different surface with no attacker present. Two independent axes define the class: persistence substrate and firing-separation. We walk a confused-deputy cron attack end-to-end through OpenClaw at a pinned commit. The defense is tiered (D1, D2, D3), and D2 carries a soundness theorem against seven named deployment invariants. D2 keys on a canonical action-instance digest with one-shot owner attestations, defeating paraphrase laundering, multi-input grant reuse, and replay. A companion artifact ships the gate, a static audit over the vendored source, and a runtime adapter realising five of the ten mediation hooks (H1, H2, H3, H6, H9) around the cron path (42 tests, Node~≥20, at hrefhttps://github.com/maloyan/sleeper-channelsgithub.com/maloyan/sleeper-channels). Empirical evaluation is preregistered as follow-on.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 17 of its 36 references that are in the map. First posted on arXiv 13 May 2026.
Builds on
17 of 36 references.
Closest ancestors · 8
Same direction, newest first
- 2025MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval18 Dec
- 2025Defeating Prompt Injections by Design24 Mar
- 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
- 2023Tensor Trust: Interpretable Prompt Injection Attacks from an Online Game2 Nov
- 2023Formalizing and Benchmarking Prompt Injection Attacks and Defenses19 Oct
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection23 Feb
Other references · 9
- 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
- 2023Are aligned neural networks adversarially aligned?cited by 315
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 267
- 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 159
- 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studiescited by 131
- 2025The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injectionscited by 129
- 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 127
- 2025Securing AI Agents with Information-Flow Controlcited by 121
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents
- 2026Architectural Obsolescence of Unhardened Agentic-AI Runtimes
- 2026ElephantAgent: Contextual State Continuity in Agentic Systems
- 2026SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains
- 2026Distributed Attacks in Persistent-State AI Control
- 2026Agent-Fence: Mapping Security Vulnerabilities Across Deep Research Agents
- 2026Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
- 2026Always-OnAgents:A Survey of Persistent Memory, State, and Governance in LLMAgents