CarryoverBench: planted LLM-agent injections re-fire after the attacker leaves
Original title: After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
On five frontier models, planted payloads showed no measurable decay over five rounds once planting succeeded.
Researchers describe carryover attacks in which a one-time indirect prompt injection stored in long-lived memory or a scheduled task re-fires in later LLM-agent sessions. CarryoverBench has 12 personal-assistant scenarios and 101 attack tasks on Instant, Autonomous and Latent trigger channels, with planting and triggering scored separately. Across five frontier models, planted payloads re-fired without measurable decay over five rounds, and a successful plant often left little extra protection at the trigger stage. Moving the Latent channel to the Hermes runtime reduced but did not remove the effect.
Unconfirmed: Findings are the authors' benchmark results; model names and real-world attacker use are not stated.
- Channels are same-turn injection, heartbeat-scheduled tasks and memory that resurfaces later.
- A rule-based verifier scores planting and triggering as independent stages.
- Authors say defense needs runtime controls as well as prompt-level checks.
- The five frontier models are not named in the abstract.
Impact: Planted prompt injections re-fire in later agent sessions
From the original article
1 min read at arxiv.orgModern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input. A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves, threats we term carryover attacks.
By Zhiyue Xu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.