REVIEW 3 major objections 5 minor 5 references
What If Prompt Injection Never Left? Rethinking Agent Security through Cross-Session Stored Prompt Injection
T0 review · 3 major / 5 minor · reviewed 2026-08-02 · deepseek-v4-flash
Pith's one-line read Prompt injection can be stored in agent memory or files and silently hijack later sessions, with end-to-end success up to 42% across tested models.
desk verdict Useful formalization and benchmark for cross-session prompt injection, but the write primitive in the experiments is closer to an authorized memory update than an adversarial injection, so the headline E2E-ASR numbers overstate the attack. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The carrying mechanism is the context-construction pipeline x_t = A(q_t, I, H_t, T, R_t, S_t), where persistent channels include agent memory, tool-visible state, and file-backed context. The paper's analytical move is the write primitive w: u → P, modeling how attacker-controlled content crosses into persistent state, combined with a taxonomy of persistence classes (ephemeral, conditionally persistent, strongly persistent) and incorporation mechanisms (direct loading versus conditional loading). A stage-wise decomposition—Write Success Rate, Incorporation Rate, Activation Rate, and their product E2E-ASR—makes the cross-session claim measurable, because the session reset isolates persistent
What would settle it
Repeat the paper's two-session protocol with a production-grade agent that prompts for explicit user confirmation before writing to memory or files, then measure whether any injected payload reaches persistent storage and later changes a clean victim query; if end-to-end success drops to near zero, the cross-session surface depends on absent write-time guards.
Extended reading notes
Core claim
The central claim is a formal definition: a stored prompt injection attack occurs when adversarial content p is written into or modifies persistent context P, later incorporated into the agent's context x_t = A(q_t, ·, P), and interpreted by the model M in a way that alters behavior beyond the intended task. The paper positions this as the agentic analogue of stored cross-site scripting: injection and exploitation become temporally decoupled, so the attacker need not be present when the payload activates. The empirical claim, measured through a two-session benchmark that resets conversation history but preserves persistent state, is that end-to-end attack success (write rate × incorporation
Load-bearing premise
The attack only matters if an attacker can actually get adversarial content written into persistent context through normal interaction—something the benchmark deliberately arranges, but production agents might block with write-time approval or provenance checks.
Editorial extensions
If this is right
- If SPI holds, any agent with durable memory, files, or tool-visible state should treat persistent context as an executable attack surface; one poisoned artifact can affect all future sessions.
- Direct-loading channels—system-level instruction files, working memory, tool descriptions—are the highest-priority hardening targets because they skip a retrieval decision and are reliably present.
- Fact manipulation is a reliable failure mode: once injected content is incorporated, models tend to treat it as ground truth, so agents need mechanisms to distinguish injected facts from verified facts.
- The stage decomposition means defenses can intervene at write, incorporation, or activation time; write-time gating and load-time provenance checks are separable control points.
- Evaluations of agent security should use session resets or otherwise control for conversation history, since only then can behavior changes be attributed to persistent state rather than same-session context.
Reading between the lines
- If production agent harnesses add explicit write-time approval or provenance checks before any memory or file mutation, the attack surface may shrink substantially; the benchmark's high write-success rate may overstate real-world reachability where such guards exist.
- The same mechanism likely enables cross-user propagation in shared workspaces or multi-tenant agents: one user's poisoned file becomes another user's context, an escalation the paper's single-victim benchmark does not yet quantify.
- A testable extension is to attach provenance tags to each context chunk—labeling it as user instruction, tool output, memory, or file—and measure whether models can be made to ignore directive-language appearing in data channels.
- If SPI generalizes, secure agent architectures should route all persistent writes through an explicit commit/audit API rather than letting model outputs implicitly mutate memory and files.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces cross-session stored prompt injection (SPI) for agentic systems, arguing that adversarial content can be written into persistent context (memory, files, tool-visible state) and later influence behavior in a future session. It formalizes a lifecycle with three stages (write, incorporation, activation), proposes a taxonomy organized by injection source, persistence channel, incorporation mechanism, and harm category, and presents a sandbox benchmark with 162 cases across three application scenarios, three models, three persistence channels, and two attack types. The headline empirical result is E2E-ASR between 32.1% and 42.0%, decomposed into WSR, IR, and AR. The paper positions SPI as the agentic analogue of stored XSS and argues for state-centric security for agent harnesses.
Significance. If the central claim is established, the paper would be a useful reframing: persistent agent state as a first-class cross-session attack surface. The stage-wise decomposition is coherent, and the session-reset isolation design is a sound way to separate persistent effects from in-session conversation history. The taxonomy is a valuable organizing device, and the reported rank-order findings (direct-loading channels outperform conditional-loading ones; fact manipulation is easier than preference manipulation; contextual disguise primarily boosts WSR) are falsifiable and generally internally consistent. The main weakness is that the empirical pipeline may be measuring authorized memory usage rather than an adversarial write primitive; until that is resolved, the quantitative claims do not yet demonstrate a vulnerability beyond intended functionality.
major comments (3)
- [§5.1, Figure 3; §3.2] The injection stage submits an 'attacker query' directly to the agent, but the paper does not show the queries or establish that they exercise an adversarial write primitive rather than the intended memory feature. If the queries are explicit user instructions to store content (e.g., 'remember ...', 'save this policy'), then WSR measures authorized persistence, and the later activation is the agent following the user's own instruction—not an attack beyond the intended task. This is load-bearing because E2E-ASR is the central empirical support. Please report the full injection-query templates, and add an injection mode in which the payload arrives through untrusted content (a document, tool output, or email) without any user instruction to persist, or explicitly model a separate victim user with distinct authority.
- [Definition #2; §3.2] The definition of SPI is satisfied whenever stored content is later incorporated and alters behavior; it does not define whose 'intended task' is violated or whether the writer has authority to modify P. As written, if the legitimate user asks the agent to memorize a policy, and the agent later follows it, this is both 'stored prompt injection' and normal agent functionality. The threat model also lists 'user-supplied content' as an injection source (§4.1), conflating a malicious user with an external adversary who has no write authority. This ambiguity makes the benchmark's results circular with respect to the definition. I recommend restricting SPI to writes that the writer is not authorized to perform, or to content that acquires directive authority the user did not request, and defining the intended task per session/victim.
- [Introduction; §5.1] The paper motivates SPI with the stored-XSS analogy, which requires a shared persistent store and a victim distinct from the injector. The benchmark's activation phase is a new session but not a different user; the same agent/user relationship persists. No access-control or multi-user shared-state scenario is evaluated. Consequently the 'across users' claim in the introduction is not supported by the experiments. Add a shared-state condition (e.g., two user profiles, a shared workspace, or a tool-visible mailbox) or soften the cross-user claim.
minor comments (5)
- [§1] Typo: 'OW ASP Foundation' should be 'OWASP Foundation' in the stored XSS reference.
- [Figure 3] The filename convention is inconsistent: 'AGENT.md' appears in Phase 1, while 'AGENTS.md' is used elsewhere. Use one consistent filename.
- [Eq. (1), §3.1] The typesetting of subscripts and spacing in the context construction formula is corrupted; also clarify whether the context is a concatenation, a set, or a structured object.
- [Tables 2–4] Percentages are reported without cell counts or confidence intervals. Since 162 cases are split across 18 condition combinations, several differences (e.g., 0% vs 11% for preference manipulation) may be based on very small denominators. Report exact counts and, where possible, uncertainty intervals.
- [§5.1] The description of '162 unique SPI cases' is not clearly linked to the experimental factor structure (3 scenarios × 3 goals × 3 channels × 2 attack types); clarify how cases are counted and distributed across conditions.
Circularity Check
No significant circularity; the paper is an empirical threat-formalization study, and its benchmark operationalizes its own definitions rather than deriving conclusions from them.
full rationale
This is not a derivation paper: there is no chain of equations from assumptions to a predicted quantity. The central construct (SPI, Definition #2) is a definition, and the benchmark metrics (WSR, IR, AR, E2E-ASR) are direct measurements of whether each lifecycle stage occurred. The paper does not fit any parameter to the data it then reports as a prediction, so the fitted-input-called-prediction pattern does not apply. There are no load-bearing self-citations: the only closely related prior work, Memory Injection (Dong et al., 2026), is cited as background and has no author overlap with this paper, and no self-citation is used to justify the core claim. The main substantive concern is construct validity, not circularity: the injection phase submits an 'attacker query' directly to the agent (§5.1, Figure 3), and the write primitive w: u → P (§3.2) is instantiated by query-induced writes, so high WSR may partly measure instruction-following for authorized storage requests rather than an adversarial bypass of write-time guards. That is a threat-modeling limitation about whether the benchmark's write channel matches real deployments, but it does not make the empirical result equivalent to the paper's input by construction. The paper even states in its Ethics Statement that it 'clarifies these risks without introducing new attack primitives,' and the benchmark uses external ground-truth checks and a hybrid verifier. Accordingly, no specific circular reduction can be exhibited, and the appropriate finding is no significant circularity, with a low score reflecting only the mild self-referential flavor inherent to defining and then benchmarking a new attack class.
Assumptions & free parameters
assumptions (4)
- domain assumption Agentic systems maintain persistent state that survives session boundaries and is later incorporated via a context construction function A.
- domain assumption Adversary possesses a write primitive w: u → P allowing external content to enter persistent context through normal interactions.
- domain assumption After session reset, any observed behavioral change in the activation session originates from persistent state, not from residual conversation history.
- domain assumption The hybrid rule-based + LLM-as-judge pipeline reliably determines attack success.
Cite this review
Pith. "Pith review of What If Prompt Injection Never Left? Rethinking Agent Security through Cross-Session Stored Prompt Injection." pith.science (2026). https://pith.science/paper/A5PNBDR2
@misc{pith2026260604425,
author = {Pith},
title = {Pith review of: What If Prompt Injection Never Left? Rethinking Agent Security through Cross-Session Stored Prompt Injection},
year = {2026},
howpublished = {\url{https://pith.science/paper/A5PNBDR2}},
note = {Machine review of arXiv:2606.04425}
}
read the original abstract
Modern agentic systems fundamentally reshape the security boundary of LLMs by introducing persistent system state including memories, filesystems, tools, and other long-lived contextual artifacts that survives across sessions. As external information crosses this boundary and becomes part of persistent agent state, malicious instructions are no longer confined to a single interaction, but can silently persist and influence future executions long after the original attacker interaction has ended. We introduce Cross-Session Stored Prompt Injection, a new threat vector inspired by stored cross-site scripting that redefines prompt injection for agentic systems by extending its threat model across both time, where attacks persist and activate across sessions, and space, where adversarial instructions propagate beyond the immediate prompt into persistent system state. To systematically characterize this emerging threat, we formalize the lifecycle of cross-session stored prompt injection, develop a taxonomy of persistence channels and incorporation mechanisms, and build a sandbox toolkit for evaluation. Our findings suggest that the fundamental challenge of agent security is not merely filtering untrusted inputs, but governing how external information acquires authority as it crosses persistent system boundaries. We hope this work motivates a broader shift from interaction-centric security toward state-centric security, making the secure management of persistent agent state a first-class security principle for the agentic era.
Figures
Figures from the paper (5 more)
Reference graph
Works this paper leans on
-
[5]
Wanjun Zhong, Lianghong Guo, Qiqi Gao, He Ye, and Yanlin Wang
Agent-safetybench: Evaluating the safety of llm agents.arXiv preprint arXiv:2412.14470. Wanjun Zhong, Lianghong Guo, Qiqi Gao, He Ye, and Yanlin Wang. 2024. Memorybank: Enhancing large language models with long-term memory. InPro- ceedings of the AAAI conference on artificial intelli- gence, volume 38, pages 19724–19731. 13 GLM-5.1 GPT-5-mini MiniMax-M2.7...
arXiv 2024
-
[2023]
Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. InAISec. Yongjian Guo, Puzhuo Liu, Wanlun Ma, Zehang Deng, Xiaogang Zhu, Peng Di, Xi Xiao, and Sheng Wen
-
[2024]
Memgpt: Towards llms as operating systems. Preprint, arXiv:2310.08560. Joon Sung Park, Joseph O’Brien, Carrie Jun Cai, Mered- ith Ringel Morris, Percy Liang, and Michael S Bern- stein. 2023. Generative agents: Interactive simulacra of human behavior. InProceedings of the 36th an- nual acm symposium on user interface software and technology, pages 1–22. Sh...
arXiv 2023
-
[2025]
12 Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasu- pat, and Mingwei Chang
Systematic analysis of mcp security.arXiv preprint arXiv:2508.12538. 12 Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasu- pat, and Mingwei Chang. 2020. Retrieval augmented language model pre-training. InInternational confer- ence on machine learning, pages 3929–3938. PMLR. Kung-Hsiang Huang, Akshara Prabhakar, Sidharth Dhawan, Yixin Mao, Huan Wang, Silvio...
arXiv 2020
-
[2026]
InThe Thirty-ninth Annual Conference on Neural Information Processing Sys- tems
Memory injection attacks on LLM agents via query-only interaction. InThe Thirty-ninth Annual Conference on Neural Information Processing Sys- tems. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz
Reviewed August 2, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.