What If Prompt Injection Never Left? Rethinking Agent Security through Cross-Session Stored Prompt Injection

Modern agentic systems fundamentally reshape the security boundary of LLMs by introducing persistent system state including memories, filesystems, tools, and other long-lived contextual artifacts that survives across sessions. As external information crosses this boundary and becomes part of persistent agent state, malicious instructions are no longer confined to a single interaction, but can silently persist and influence future executions long after the original attacker interaction has ended. We introduce Cross-Session Stored Prompt Injection, a new threat vector inspired by stored cross-site scripting that redefines prompt injection for agentic systems by extending its threat model across both time, where attacks persist and activate across sessions, and space, where adversarial instructions propagate beyond the immediate prompt into persistent system state. To systematically characterize this emerging threat, we formalize the lifecycle of cross-session stored prompt injection, develop a taxonomy of persistence channels and incorporation mechanisms, and build a sandbox toolkit for evaluation. Our findings suggest that the fundamental challenge of agent security is not merely filtering untrusted inputs, but governing how external information acquires authority as it crosses persistent system boundaries. We hope this work motivates a broader shift from interaction-centric security toward state-centric security, making the secure management of persistent agent state a first-class security principle for the agentic era.