{"id":"b9d1028a-22c0-4691-93d6-1db53d41241b","arxiv_id":"2607.19433","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"The paper is a taxonomy of persistent memory-based attacks on AI agents, reinterpreting known attacks (MINJA, EchoLeak, sleeper agents) under the umbrella 'Chronos Vulnerability' and proposing a defense-in-depth architecture.","lead":"This paper names a new class of AI security threats—'Chronos Vulnerability'—where attackers poison an AI agent's long-term memory to control it later. It surveys existing attacks and defenses and argues that traditional content filters cannot stop these persistent, time-delayed attacks.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Implicit-trust axiom in §II-C is asserted, not established; if production agents validate memory provenance, the claimed generality of 'Chronos' collapses.","rationale":"I agree with the reader's weakest_assumption. Section II-C is the load-bearing foundation: all persistence-based attacks—MINJA, memory grafting, sleeper-agent incubation—depend on retrieved memory being used as an authoritative premise. The paper presents this as an axiom but provides no evidence of universality. The only direct empirical support is the MINJA paper, which targets a specific agent configuration. The WoW benchmark does not test security; it documents performance collapse, and the inference from task failure to exploitability is a logical gap. The absence of a limitations section or explicit scoping makes the overgeneralization more problematic. However, this is not fatal to the taxonomy as a threat model: the paper can be read as 'if memory is implicitly trusted, then these attacks are possible,' and the defenses it catalogs remain relevant. Thus CONDITIONAL remains the right verdict: accept the classification as a useful synthesis, but require the authors to either scope the claim to unhardened systems or add a direct exploitability study linking Dynamics Blindness to security outcomes. No change from the reader's verdict is needed, though the rationale for CONDITIONAL should explicitly cite the implicit-trust universalization as the primary condition.","tokens_in":7871,"tokens_out":4122,"duration_ms":55344,"concrete_test":"Run the MINJA attack (Dong et al., 2025) against a production-grade RAG agent (e.g., LangChain memory + OpenAI) under two conditions: (1) raw retrieval with no provenance checks, and (2) retrieval augmented with provenance metadata and a system prompt instructing the model to treat retrieved context as untrusted and to verify against a trusted source list. Measure Injection Success Rate on a fixed set of 100 tasks. If condition (2) reduces ISR to near zero, the implicit-trust axiom is not universal and the paper's claimed generality is unsupported. If ISR remains high (>50%) despite provenance warnings, the axiom is robust and the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The entire Chronos threat model rests on Section II-C's 'Axiomatic Duality of Memory and Belief': retrieved memories are treated as authoritative premises without independent provenance verification. The paper cites MINJA as evidence, but MINJA demonstrates exploitability on a specific agent, not that this holds for the 'current stateful architecture' generally. No survey or measurement establishes that production agents lack provenance checks, memory consensus, or instruction-level untrusted-context handling. The paper's own defense taxonomy (A-MemGuard consensus, MemTrust cryptographic provenance) implicitly acknowledges that memory should not be trusted by default, creating a tension: if those defenses are necessary, the vulnerable default may be widespread, but if they are already deployed, the claimed generality fails. Furthermore, the WoW benchmark (Table IV) measures task success rate collapse, not attack success; the leap from 'Dynamics Blindness' to 'endpoint filters are insufficient' is asserted without a security experiment. The central claim—that persistent memory creates a distinct, decoupled attack class that endpoint filters cannot prevent—is therefore conditional on an unverified universal property of agent memory pipelines.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a new vulnerability class, \"Chronos Vulnerability,\" for stateful agentic AI: memory-based attacks that persist over time and decouple the injection from the catastrophic action. It surveys MINJA, MemoryGraft, sleeper agents, session smuggling, and EchoLeak; introduces \"Dynamics Blindness\" as a performance gap observed on the World of Workflows benchmark; and synthesizes a defense-in-depth taxonomy (AgentDoG, Agent-C, A-MemGuard, GPU TEEs, MemTrust). The abstract and conclusion claim that this analysis demonstrates the insufficiency of traditional endpoint content filters against the current stateful architecture.","tokens_in":8052,"tokens_out":4852,"duration_ms":61027,"significance":"As a synthesis and taxonomy, the paper is useful: it brings together recent memory-poisoning attacks and defense families, and it correctly identifies that the shift from stateless to stateful agent architectures expands the attack surface beyond session-scoped prompt injection. The description of MINJA, MemoryGraft, EchoLeak, and sleeper-agent results is generally faithful to the cited literature, and the paper has no author-fitted parameters or self-referential circularity. However, the contribution as written is largely definitional, and the central empirical claim—that endpoint filters are demonstrated insufficient—is not supported by any security experiment or direct evidence.","major_comments":[{"comment":"The abstract and §V claim that the WoW benchmark results \"demonstrat[e] that traditional endpoint content filters are insufficient.\" Table IV reports Task Success Rate Under Constraint (TSRUC) collapsing (e.g., GPT-4 from 22.0% to 2.0%; mean relative drop 87.6%). This is a task-completion metric on a benchmark, not a security evaluation. There is no endpoint-filter condition, no attack attempt, no injection-success rate, and no comparison before/after filtering. The quantitative finding therefore does not support the stated conclusion. The wording should be revised from \"demonstrating\" to \"motivating\" or \"suggesting,\" or the authors should run the missing security experiment.","section":"Abstract; §V, Table IV"},{"comment":"The entire threat model rests on the \"Axiomatic Duality of Memory and Belief\": retrieved memories are treated as authoritative premises without independent provenance verification. This is asserted, not established. The paper does not survey production agent memory pipelines to show they lack provenance checks, consensus validation, or instruction-level untrusted-context handling. Moreover, the paper's own defense taxonomy (§VI-C, §VII-C) argues for A-MemGuard consensus and MemTrust cryptographic provenance as necessary. If such defenses are necessary, the vulnerable default may be widespread; but if they are already deployed, the claimed generality of the Chronos Vulnerability collapses. Please make this an explicit, bounded assumption about the default architecture, or provide evidence of its prevalence.","section":"§II-C"},{"comment":"EchoLeak is described as a zero-click prompt-injection exploit via RAG retrieval of an email, exfiltrating data in the same retrieval/query cycle. It does not poison persistent memory or create the decoupled, time-shifted attack vector that defines the Chronos Vulnerability. Including it under the Chronos umbrella weakens the internal consistency of the taxonomy. Either articulate the persistence mechanism that makes EchoLeak a temporal memory attack, or reposition it as a related but distinct RAG-injection case.","section":"§IV"},{"comment":"The paper states that Dynamics Blindness is \"the primary obfuscation layer attackers leverage\" to induce silent failures. However, the WoW benchmark results measure benign task-performance gaps (Representation, Dynamics, Observability), not adversarial robustness. No evidence is presented that attackers exploit these gaps to conceal memory injections or to decouple attack vectors from catastrophic events. The connection between Dynamics Blindness and the Chronos Vulnerability is therefore asserted rather than demonstrated. Please provide a concrete mechanism or explicitly label this as a hypothesis for future work.","section":"§V"}],"minor_comments":[{"comment":"The section header \"THEMOAT OF MEMORY\" appears to be a typo for \"THE MOAT OF MEMORY.\"","section":"Section II heading"},{"comment":"The term \"vibe-coding\" is informal and deserves a brief definition or citation, especially since it appears in the abstract and conclusion as a framing device.","section":"§I"},{"comment":"\"NVIDIA's H100 GPU with Confidential Computing-On\" is awkward and unclear; consider \"Confidential Computing enabled\" or \"Confidential Computing mode.\"","section":"§VII-A"},{"comment":"The conclusion contains a grammatical error: \"toward to create a secure agentic environment\" should be \"toward creating.\"","section":"§VIII"},{"comment":"The ATBench dataset is mentioned in §VI-A but is not given a full reference. Please add the source or remove the name if it is not essential.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper reads more like a well-structured position paper or survey than an experimental demonstration. The taxonomy of memory-based attacks and defenses is useful and the citation of recent work appears accurate. The main barrier is the mismatch between the claimed empirical demonstration and the actual content: no security experiments are reported, and the WoW benchmark is used as a proxy for a claim about endpoint filters. This is fixable by reframing the contribution as a taxonomy with explicit assumptions and open hypotheses. I see no evidence of misconduct or circularity."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know: this is a synthesis/taxonomy paper, not a new result. The 'Chronos Vulnerability' is a useful umbrella term for persistence-based memory attacks, and the paper cleanly maps MINJA, sleeper agents, session smuggling, and EchoLeak onto a session-vs-persistence distinction. But every concrete component is imported from cited prior work; the only original content is the naming and the bundling. The 87.6% figure is recomputed from the WoW benchmark paper, and the arithmetic checks out.\n\nWhat it does well: it's well-structured, faithful to the sources, and gives a newcomer a solid map of the attack and defense landscape. The defense taxonomy (trajectory guardrails, formal temporal verification, memory consensus, hardware trust) is a reasonable organizing scheme. The distinction between transient prompt injection and persistent memory poisoning is real and worth articulating. I'd point someone who asks 'what's happening with agent memory attacks?' to this as a starting bibliography.\n\nSoft spots, in proportion. The biggest one is the asserted 'Axiomatic Duality of Memory and Belief' in Section II-C: the claim that agents treat retrieved memories as authoritative premises is stated, not established. The paper's own defense taxonomy (A-MemGuard consensus, MemTrust cryptographic provenance) implicitly admits memory should not be trusted by default, which undercuts the universality of the claimed vulnerability. Second, the WoW benchmark data shows a performance collapse (TSRUC drop), not an exploit; the leap from 'Dynamics Blindness' to 'endpoint filters are insufficient' is a hypothesis, not a demonstration. The abstract's 'demonstrating' and 'formalizes' overstate what is actually a survey with a recomputed statistic. These are framing and evidence gaps, not fatal errors. There are no fitted parameters, no self-citations, and no circular reasoning; the paper is honest about its sources.\n\nWho this is for: people new to agentic AI security who want a structured overview, and anyone looking for a common vocabulary for memory-based attacks. The taxonomy could be a useful reference if the community adopts the term, but I wouldn't cite it for any empirical claim.\n\nRecommendation: send it to peer review as a survey/taxonomy, but with revisions. The authors should either soften the claims to match the evidence or add a concrete experiment showing that a memory-poisoned agent succeeds where an endpoint filter would have blocked the attack. As it stands, the core intuition is plausible and worth discussing, but the empirical wrapper needs to match the actual contribution.","headline":"A competent taxonomy that repackages known attacks and defenses under a catchy label, but overclaims its empirical demonstration and rests on an unproven axiom about memory trust.","tokens_in":8634,"tokens_out":1834,"would_cite":false,"duration_ms":23747,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that persistent memory in agentic AI enables a distinct class of time-decoupled attacks—dubbed the Chronos Vulnerability—that endpoint content filters cannot stop.","keywords":["agentic AI","Chronos vulnerability","memory injection","MINJA","sleeper agents","dynamics blindness","zero-trust memory","trusted execution environment"],"falsifier":"Deploy the same RAG agent twice, with and without memory provenance validation; poison both memories identically via MINJA's Progressive Shortening Strategy, then measure injection success rate against benign trigger queries. If the provenance-validating agent shows no delayed harmful action while the baseline does, the paper's implicit-trust premise is the load-bearing factor; if both fail, the threat model needs revision.","tokens_in":7694,"feed_emoji":"⏳","tokens_out":5502,"duration_ms":59508,"temperature":0.7,"pith_summary":"The paper attempts to establish that the evolution from stateless chatbots to stateful autonomous agents introduces a new class of security vulnerability, which it names the Chronos Vulnerability. In this class, an attacker plants a poisoned memory in the agent's long-term store and lets it lie dormant; when a benign user query later retrieves it, the agent trusts the memory as a premise and reasons to a harmful action, so the injection and the catastrophe are separated in time. The paper organizes these attacks—memory injection (MINJA), memory grafting, sleeper agents, and session smuggling—into a taxonomy, and argues that because agents implicitly trust retrieved content, endpoint content filters that police individual sessions are structurally unable to stop them. It also introduces the concept of Dynamics Blindness, an agent's failure to anticipate cascading effects of its own actions, citing an 87.6% average relative drop in task success on the constrained World of Workflows benchmark, and synthesizes a defense-in-depth stack ranging from trajectory guardrails and formal temporal verification to immune-style memory consensus and hardware-based trusted execution.","feed_headline":"Persistent memory turns AI agents into sleeper targets","feed_subtitle":"The paper identifies a time-decoupled attack class where poisoned memories wait dormant until a benign query activates them.","key_machinery":"The load-bearing mechanism is implicit-trust memory retrieval, stated as the 'Axiomatic Duality of Memory and Belief': any information pulled from the vector database is treated as a premise without provenance verification. That assumption is what converts a single poisoned entry into a durable belief and, through Recursive Belief Confirmation and hallucination spirals, makes the agent defend the false belief against correction. The paper stratifies memory into episodic, semantic, procedural, factual, and working layers with distinct vulnerability axes, and pairs each attack class with a corresponding defense mechanism—diagnostic trajectory guardrails, formal temporal conformance via SMT sol","core_discovery":"The paper's central claim is that the introduction of persistent memory to agentic AI creates a new vulnerability class in which an attacker can compromise the agent's belief system without touching the final catastrophic action. Because agents assign implicit trust to retrieved memories, a poisoned entry planted weeks earlier—via a memory injection attack (MINJA) or stealthier memory grafting—becomes a premise in future reasoning, and when it produces successful tool outputs, the agent's belief in it is reinforced in a recursive confirmation loop. The paper calls this time-decoupled, durable compromise the Chronos Vulnerability, and contrasts it with session-based prompt injection, which en","pith_inferences":["A testable extension: measure whether per-entry provenance validation (each memory tagged with source and trust level) removes the MINJA success rate on the same benchmark; if it does, the paper's implicit-trust premise is the precise bottleneck.","The paper's taxonomy suggests that 'forgetting' is a security feature: cryptographic erasure of stale memories could shrink the attack surface, and might be more effective than trying to detect poisoned entries after the fact.","The decoupling principle likely generalizes beyond memory stores to any long-lived internal state—planning buffers, tool caches, or learned preferences—so the Chronos framing may apply to multi-agent coordination as rogue sub-agents smuggle commands between legitimate sessions.","Dynamics Blindness quantifies a failure that may also affect attack success: an attacker can exploit hidden cascading state to make the agent's harmful action look like an innocent tool call, suggesting that testable red-team scenarios should use enterprise workflows with hidden state rather than general web tasks."],"forward_implications":["If the Chronos Vulnerability holds, any security review of an agentic system must audit the memory store's ingestion path, not just the prompt-facing endpoint.","A memory-poisoned agent can cause harm weeks after the attacker's last interaction, so incident attribution and rollback require logging the full reasoning trajectory, as AgentDoG-style guardrails provide.","Endpoint content filters are structurally insufficient for stateful agents; defenses must enforce temporal constraints on the whole tool-call sequence (Agent-C) and consensus-check memory retrievals (A-MemGuard).","The WoW-based Dynamics Blindness results imply that constrained enterprise workflows, where hidden state is common, are the highest-risk deployment context for these attacks.","Hardware TEEs can ground memory integrity at the infrastructure layer, with roughly 2% throughput overhead when NUMA and PCIe are properly orchestrated."],"fun_headline_variants":["Memory poisoning turns AI agents into sleeper threats","AI memory attacks: the time-decoupled deception","How persistent memory creates AI sleeper agents","The Chronos vulnerability: memory-based AI deception","Agentic AI's memory: a hidden attack surface"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The threat model rests on the premise that agents retrieve memory with implicit trust and never check provenance or consistency; if production agents validate the source of each memory before reasoning, the decoupled attack described as the Chronos Vulnerability does not hold with the claimed generality.","fun_headline_variants_meta":{"raw":{"variants":["Memory poisoning turns AI agents into sleeper threats","AI memory attacks: the time-decoupled deception","How persistent memory creates AI sleeper agents","The Chronos vulnerability: memory-based AI deception","Agentic AI's memory: a hidden attack surface"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000566,"raw_usage":{"total_tokens":2500,"prompt_tokens":706,"completion_tokens":1794,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":450,"completion_tokens_details":{"reasoning_tokens":1737}},"tokens_in":450,"tokens_out":1794,"duration_ms":15104,"temperature":1.0,"reasoning_tokens":1737,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T15:00:46.617332+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Deploy the same RAG agent twice, with and without memory provenance validation; poison both memories identically via MINJA's Progressive Shortening Strategy, then measure injection success rate against benign trigger queries. If the provenance-validating agent shows no delayed harmful action while the baseline does, the paper's implicit-trust premise is the load-bearing factor; if both fail, the threat model needs revision.","supporting_citations":[],"review_version":1}