After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input. A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves, threats...
Zhi-Yu Xu, Xu-Kai Wang, Zhiyuan Huang et al.
· 0 citations