mlsanityData to 7 Oct 2026

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

arXiv 2605.15338 ↗First posted 14 May 2026cs.CR cs.AIcited by 22

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Large language models are increasingly augmented with persistent memory, allowing assistants to store user-specific information across sessions for personalization and continuity. This statefulness introduces a new security risk: adversarial content can corrupt what an assistant remembers and thereby influence future interactions. We propose and study sleeper memory poisoning, a delayed attack in which an adversary manipulates external context, such as a document, webpage, or repository, to cause the assistant to store a fabricated memory about the user. Unlike conventional prompt injection, the attack can remain dormant and re-emerge across multiple later conversations. We evaluate the full attack pipeline: whether poisoned memories are written, later retrieved, and ultimately used to steer the following conversations. Across stateful LLM assistants, poisoned memories were added up to 99.8% on GPT-5.5 and 95% on Kimi-K2.6. Crucially, among successful retrievals, poisoned memories cause attacker-intended agentic actions in 60-89% of evaluations across models. These results show that persistent memory can act as a long-term attack surface across multiple future conversations.

Key facts. Cited by 22 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 24 of its 72 references that are in the map. First posted on arXiv 14 May 2026.

Builds on

24 of 72 references.

Closest ancestors · 7

Same direction, newest first

  1. 2026Sleeper Cell: Injecting Latent Malice Temporal Backdoors into Tool-Using LLMs2 Mar
  2. 2026Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks23 Feb
  3. 2025Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution1 Jun
  4. 2025Prompt Injection Attack to Tool Selection in LLM Agents28 Apr
  5. 2025Memory Injection Attacks on LLM Agents via Query-Only Interaction5 Mar
  6. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  7. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan

Other references · 17

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  2. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  3. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  4. 2025GEPA: Reflective Prompt Evolution Can Outperform Reinforcement Learningcited by 449
  5. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 237
  6. 2019BIGPATENT: A Large-Scale Dataset for Abstractive and Coherent Summarizationcited by 155
  7. 2021A Survey On Universal Adversarial Attackcited by 59
  8. 2022mFACE: Multilingual Summarization with Factual Consistency Evaluationcited by 42
  9. 2025Lessons from Defending Gemini Against Indirect Prompt Injectionscited by 40
  10. 2026Hyperagentscited by 40
  11. 2025Position: Episodic Memory is the Missing Piece for Long-Term LLM Agentscited by 35
  12. 2025CIMemories: A Compositional Benchmark for Contextual Integrity of Persistent Memory in LLMscited by 22
5 more
  1. 2026PersistBench: When Should Long-Term Memories Be Forgotten by LLMs?cited by 16
  2. 2026The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggerscited by 13
  3. 2026Toward Personalized LLM-Powered Agents: Foundations, Evaluation, and Future Directionscited by 10
  4. 2026Stateless Yet Not Forgetful: Implicit Memory as a Hidden Channel in LLMscited by 3
  5. 2025MLCPD: A Unified Multi-Language Code Parsing Dataset with Universal AST Schemacited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 22.

22 papers.

Sort:

By area:

  1. 2026From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agentscited by 29
  2. 2026Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guaranteescited by 14
  3. 2026MAP-Graph: Provenance-Aware Shared Memory for Multi-Agent Workflowscited by 7
  4. 2026When Does Belief-Based Agent Memory Help? Reliability-Conditional Updating and Provenance-Capped Poisoning Defensecited by 6
  5. 2026When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundarycited by 6
  6. 2026Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interactioncited by 4
  7. 2026Forensic Trajectory Signatures for Agent Memory Poisoning Detectioncited by 2
  8. 2026MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repaircited by 2
  9. 2026Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agentscited by 1
  10. 2026HarnessSafe: Evaluating Safety Across Persistent Carriers in Agent Harnessescited by 1
  11. 2026Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systemscited by 1
  12. 2026Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Rankingcited by 1
10 more
  1. 2026Ground Truth First: A Longitudinal Evaluation Instrument for Agent Memory, and the Tenure Crossover in Memory-Architecture Rankingscited by 0
  2. 2026ContainmentBench: Trace-Based Evaluation of Post-Exposure Containment in Tool-Using LLM Agentscited by 0
  3. 2026Shared Organizational Memory for Enterprise Coding Agents: System Design and Deployment Snapshotcited by 0
  4. 2026Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenariocited by 0
  5. 2026ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systemscited by 0
  6. 2026Transferable End-to-End Optimization for Indirect Long-Term Memory Poisoning in LLM Agentscited by 0
  7. 2026Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agentscited by 0
  8. 2026From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agentscited by 0
  9. 2026Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agentscited by 0
  10. 2026The Cognitive Continuity Test: Verifying Governed State Transitions in Persistent AI Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
  2. 2026When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents
  3. 2026MemEvoBench: Benchmarking Safety Risks from Memory Misevolution in LLM Agents
  4. 2026MemAudit: Post-hoc Auditing of Poisoned Agent Memory via Causal Attribution and Structural Anomaly Detection
  5. 2026Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents
  6. 2026Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents
  7. 2025MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval
  8. 2026When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents