The Chronos Vulnerability: A Taxonomy of Temporal Persistence and Memory-Based Deception in Agentic AI
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
The transition from stateless generative models in artificial intelligence to stateful, autonomous agents represents an architectural evolution that, while providing the capabilities of long-term planning and the automation of enterprise workflows, also represents the introduction of a new form of security threat, the Chronos Vulnerability. The Chronos Vulnerability represents the threat of memory-based attacks, including the Memory Injection Attack (MINJA) and the sleeper agent, in which the internal belief system of the autonomous agent is compromised, effectively decoupling the attack vector from the final catastrophic event. This study formalizes the threat model for persistence-based attacks and the threat of Dynamics Blindness in the context of the World of Workflows benchmark, demonstrating that traditional endpoint content filters are insufficient for the current stateful architecture. Consequently, this study synthesizes a defense-in-depth landscape, categorizing emerging frameworks such as diagnostic trajectory guardrails (AgentDoG), formal temporal verification (Agent-C), immunological memory consensus (A-MemGuard), and hardware-anchored trust via GPU-based Trusted Execution Environments (TEEs) and Zero-Trust memory architectures.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 19 of its 26 references that are in the map. First posted on arXiv 20 Jul 2026.
Builds on
19 of 26 references.
Closest ancestors · 4
Same direction, newest first
- 2025Enforcing Temporal Constraints for LLM Agents25 Dec
- 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents24 Mar
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases17 Jul
- 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan
Other references · 15
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
- 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,568
- 2023Voyager: An Open-Ended Embodied Agent with Large Language Modelscited by 2,191
- 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2023MemGPT: Towards LLMs as Operating Systemscited by 1,389
- 2023AgentBench: Evaluating LLMs as Agentscited by 1,267
- 2023Mind2Web: Towards a Generalist Agent for the Webcited by 1,242
- 2025Flow-of-Action: SOP Enhanced LLM-Based Multi-Agent System for Root Cause Analysiscited by 34
- 2025EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM Systemcited by 29
- 2025Confidential LLM Inference: Performance and Cost Across CPU and GPU TEEscited by 5
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026ElephantAgent: Contextual State Continuity in Agentic Systems
- 2026AgentKernel: The Trust-Native Agentic Operating System
- 2026MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI
- 2026SynChain: Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains
- 2026A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework
- 2026Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
- 2026Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration
- 2025A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents