Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Personal AI agents that remember emails and calendar events can be poisoned by ordinary messages, letting attackers later steer their actions without ever touching the memory store.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-11 05:26 UTC pith:MJ76XM6X

load-bearing objection Realistic indirect memory poisoning on five SOTA agent memories is measured cleanly; the ~60% activation number is an isolation upper bound, not a production severity claim. the 3 major comments →

arxiv 2607.06595 v1 pith:MJ76XM6X submitted 2026-07-06 cs.CR cs.AI

When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents

George Torres , Sharad Shrestha , Satyajayant Misra This is my paper
classification cs.CR cs.AI
keywords memory poisoningLLM agentslong-term memorypersonal assistant agentsGhostWriterAM-Sentrytool-using agentsretrieval-augmented agents
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Personal assistant agents store facts and workflows from emails and calendar invites so they can act across sessions without huge context windows. The authors show that an outsider who can only send a normal-looking message can plant a malicious fact or instruction in that store; when the user later issues a benign request, the poisoned memory is retrieved and changes what the agent does. Across five current memory architectures and four language models, nearly every payload is saved and about three in five later activations succeed. The root cause is that today’s memory systems admit almost everything and never re-check what they pull back. The authors therefore introduce AM-Sentry—admission policies of increasing strictness plus a retrieval screen—and show the combination sharply cuts end-to-end attack success while leaving ordinary recall and tool use close to baseline.

Core claim

GhostWriter is a two-phase attack that poisons a tool-using personal agent’s long-term memory solely through untrusted inputs such as emails and calendar invites. Injection embeds a payload that ordinary ingestion turns into a stored memory; activation occurs when a later benign user prompt retrieves that memory and steers the agent toward integrity corruption, leakage, covert exfiltration, or scope escalation. On five state-of-the-art agents and four models, injection succeeds at roughly 98 percent and activation averages roughly 60 percent. The authors attribute this to missing security-focused memory governance and propose AM-Sentry—three graded save policies plus an optional retrieval sc

What carries the argument

GhostWriter’s two-phase protocol (black-box payload optimization against topic clusters, then dormant retrieval on a matching user query) paired with AM-Sentry’s dual gates: memory-saving policies S1–S3 that score origin, trust, type, utility or a seven-item checklist before admission, and a retrieval screen that drops directive, contradictory, or untrusted unverifiable memories before they enter context.

Load-bearing premise

The defense rests on LLM judges and hand-chosen numeric thresholds tuned only on a synthetic workweek and non-adaptive attackers; if those scores fail under adaptive payloads or real traffic, both security and utility claims weaken.

What would settle it

An adaptive attacker who knows AM-Sentry’s checklist and thresholds produces descriptive emails that still achieve high injection and activation against the strictest S3-plus-retrieval-screen setup on the same five agents, or a live deployment with real inbox traffic shows residual attack success or utility collapse well above the reported levels.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Any personal agent that auto-ingests email or calendar content into long-term memory is currently exposed to remote memory poisoning without account compromise.
  • Trajectory-style memory reduces GhostWriter activation relative to fact stores but remains highly vulnerable to ordinary prompt injection.
  • Existing prompt-injection detectors largely miss descriptive GhostWriter payloads, so memory-specific governance is required.
  • Graded admission policies plus retrieval screening can bring end-to-end attack success below roughly 12 percent on capable models at modest utility cost.
  • Releasing the attack harness and utility suite lets others measure new agents and defenses against the same baseline.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Agents that also ingest documents, web pages, or code repositories will face the same indirect poisoning path once those channels write to shared memory.
  • Adaptive adversaries who know the checklist thresholds or second-judge prompt may systematically score above the admission gates, so reported defense numbers are an upper bound on protection.
  • Source-trust modeling will become a first-class design choice for any production memory layer rather than an optional add-on.
  • Shared multi-tenant memory could amplify a single successful injection across many agents if provenance is not isolated.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces GhostWriter, a two-phase memory-poisoning attack on long-term-memory personal LLM agents that injects adversarial content solely through untrusted tool inputs (email/calendar) and later activates it on benign user prompts. Across five adapted SOTA memory agents and four LLMs, the authors report ~98% injection success and ~60% average activation, contrasting this with weaker prompt-injection results. They propose AM-Sentry, combining three graded memory-saving policies (S1–S3) with an optional retrieval screen, and show that the strictest configurations reduce end-to-end attack success substantially (often under ~12% on capable models) while keeping custom recall/task utility near baseline. The work formalizes injection/activation protocols, a black-box retrieval-optimization procedure, and a synthetic five-day workweek plus custom utility suite.

Significance. If the results hold under more realistic traffic, this is a timely and practically important contribution: it identifies a realistic attack surface (indirect poisoning via ordinary tool channels without memory or API access) at the under-studied intersection of conversational and action-planning memory agents, and pairs the attack with a modular, architecture-agnostic defense that is evaluated for both security and utility. Strengths include multi-agent/multi-model measurement, explicit two-phase success criteria, comparison to prompt injection and A-MAC, formal protocols, and a planned release of attack and utility tooling. The work is therefore of clear interest to the agent-security community even if some severity numbers are upper bounds under isolation.

major comments (3)
  1. [§7.2, Protocol 3, abstract] §7.2 and Protocol 3 measure Phase-2 activation by resetting each agent to a clean five-day snapshot, injecting a single optimized payload, then issuing one matching benign trigger. There is no concurrent legitimate email/calendar stream competing for the same top-k retrieval slots, no multi-payload interference, and no measurement of how long a poisoned entry remains retrievable as the store continues to grow. Section 8 lists concurrent payloads and real multi-source traffic as future work, so the headline ~60% activation (and the residual “under 12%” defense figure) is an upper bound under idealized isolation. Either add concurrent-traffic experiments or restate the activation claim explicitly as an isolation upper bound and qualify the abstract/§1 severity language accordingly; without that, the practical severity of GhostWriter is overstated.
  2. [§5.1, Protocols 4–5, §8] §5.1 Protocols 4–5 and Tables 1–2 define AM-Sentry’s S2/S3 gates with hand-chosen weights and thresholds (e.g., U=0.6u+0.4r with admit if U>0.4 and V<0.6; hard reject if s1<0.6; F=0.6C+0.4N with reject if F<0.4). Section 8 acknowledges that these weights are “intuitively chosen” and not optimized. Because the defense’s reported effectiveness rests on these free parameters, the paper needs at least a sensitivity analysis (or the Monte Carlo optimization already listed as future work) showing that residual attack success and utility do not collapse under modest weight/threshold perturbation; otherwise the “dramatically reduces” claim is tied to an unvalidated design point.
  3. [§6.2, §7.5, §8] §6.2 and §7.5 evaluate both attack realism and utility solely on a synthetic five-day workweek and a custom recall/task suite. The authors correctly note that LoCoMo/HotpotQA/Webshop are imperfect fits, but the manuscript still treats the synthetic suite as sufficient to claim that AM-Sentry “preserves agent utility.” At minimum, report inter-annotator or cross-model agreement for the LLM-judge utility scores, and discuss how results might change under multi-source, multi-user, or longer-horizon traffic; otherwise the security–utility tradeoff is only demonstrated inside the authors’ own generator.
minor comments (5)
  1. [§7.2–7.3] Two distinct figures are both labeled “Figure 7” (P2 activation heatmaps vs. prompt-injection results). Renumber and fix cross-references.
  2. [Figure 3] Figure 3 / memory-store diagrams contain typos such as “Past dsicussions” and “Past dsicussions”; clean figure text.
  3. [§7.1] §7.1 sets temperature 0.7 “where applicable” and uses different embedding models for agent vs. adversary; briefly justify that the adversary’s bge-small-en-v1.5 vs. agents’ all-MiniLM-L6-v2 is intentional black-box mismatch rather than an uncontrolled confound.
  4. [Appendix D] Appendix D utility plots for Mem0/Letta/ExpeL/MemoryOS are dense; consider a compact table of deltas vs. baseline for F1, LLM-judge, and tool accuracy to make the “minimal impact” claim easier to verify.
  5. [§1, Appendix B] Clarify whether the 16 attack scenarios and payload variants will be released with the promised toolkit so that others can reproduce the exact P1/P2 rates.

Circularity Check

0 steps flagged

No significant circularity: GhostWriter rates and AM-Sentry results are empirical measurements, not predictions reduced by construction to fitted inputs or self-citation chains.

full rationale

This is an empirical systems/security paper. The load-bearing claims (~98% injection, ~60% activation; AM-Sentry residual success and utility) are measured outcomes of Protocols 1–3 and the §6–7 evaluation suite against five agents and four LLMs, not first-principles derivations. Memory-saving equations (S2 usefulness U=0.6u+0.4r and vulnerability V; S3 checklist F=0.6C+0.4N and hard reject on s1) are free design thresholds of the proposed defense; the paper does not claim they mathematically imply the attack rates, nor does it fit those weights to the attack data and then re-report them as predictions. Protocol 2’s black-box similarity Score(p,T,E) optimizes adversary payloads; it is not used to define or force the reported activation metric. Related-work citations (AgentPoison, MINJA, A-MAC, Zombie Agents, etc.) are external and used for contrast, not as load-bearing uniqueness theorems by overlapping authors. The custom synthetic workweek and utility suite are author-built evaluation instruments, which raises external-validity questions but does not make any reported quantity equal to its inputs by construction. No self-definitional loop, fitted-input-as-prediction, uniqueness import, ansatz smuggling, or renaming of a known result as a forced derivation is present. Score 0 is the correct honest finding.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 2 invented entities

The central claims rest on a realistic personal-assistant threat model, empirical success definitions for injection/retrieval/activation, and AM-Sentry’s LLM-judge plus threshold logic. Free parameters are the hand-set policy weights/thresholds and experimental knobs; axioms are standard security isolation assumptions and the reliability of LLM judges; invented entities are the named attack and defense frameworks themselves, which are operational constructs rather than physical postulates.

free parameters (4)
  • S2 usefulness weights and thresholds (U=0.6u+0.4r; admit if U>0.4 and V<0.6)
    Chosen by authors without reported optimization; admission rates and utility depend on these cutoffs.
  • S3 checklist weights and thresholds (hard reject s1<0.6; F=0.6C+0.4N; reject if F<0.4)
    Strictness of the strongest defense is controlled by these hand-set numbers; future work notes Monte Carlo weight search.
  • Black-box retrieval optimization threshold τ and topic count k
    Adversary payload rewriting loop stops when Score(p,T,E) exceeds τ after clustering corpus into k topics; values affect activation realism.
  • Retrieval window size k and model temperature 0.7
    Affect which poisoned memories enter context and stochastic agent behavior; defaults used without full sensitivity analysis.
axioms (4)
  • domain assumption Agent core execution logic is benign and free of malicious hardcoded actions.
    Stated in Section 3.2 security assumptions; required so observed misbehavior is attributed to memory content.
  • domain assumption Memory infrastructure is cryptographically/logically isolated; adversary cannot tamper out-of-band or access agent API/user credentials.
    Section 3.2–3.3; defines the black-box tool-input threat model that distinguishes GhostWriter from AgentPoison/MINJA.
  • ad hoc to paper LLM judges can score origin, trust, type, utility, vulnerability, and retrieval safety well enough to gate memories without collapsing utility.
    AM-Sentry’s entire defense depends on this; Llama results show the assumption fails for weaker models (overblock or underblock).
  • ad hoc to paper A synthetic five-day workweek plus custom recall/task suite is a valid proxy for personal-assistant utility and attack realism.
    Sections 6.2 and 8; no real user data or live deployment evaluation.
invented entities (2)
  • GhostWriter attack vector (injection + activation via tool inputs) independent evidence
    purpose: Name and formalize the two-phase indirect memory poisoning path against personal agents.
    Operational attack construct; independent evidence is the reported empirical rates on existing agents, not an external physical prediction.
  • AM-Sentry (S1/S2/S3 memory-saving policies + retrieval screen) no independent evidence
    purpose: Provide architecture-agnostic two-stage memory governance against GhostWriter.
    Defense framework introduced by the paper; effectiveness is measured only within the paper’s experiments.

pith-pipeline@v1.1.0-grok45 · 23997 in / 3552 out tokens · 31747 ms · 2026-07-11T05:26:31.634066+00:00 · methodology

0 comments
read the original abstract

Personal AI agents powered by large language models can reason and act using available tools to access emails, manage calendars, and push code to remote repositories, all with minimal oversight. When augmented with long-term memory, an agent can recall specific details relevant to the current task, reducing the need for large context windows. Currently, long-term memory agents tend to fall into two distinct domains: conversational and action-planning agents. Personal assistant agents sit at the convergence of these two domains and handle sensitive information while interacting with untrusted information sources, creating previously unaccounted security vulnerabilities. In this work, we introduce the novel attack vector, GhostWriter, which exploits current memory subsystems in tool-using personal agents to poison their memory store. GhostWriter operates in two phases: injection, where an adversary sends a hidden attack payload to the target agent; and activation, in which the poisoned memory is retrieved. We show that GhostWriter achieves near-universal injection rates of approximately 98% and a high average activation rate of approximately 60% against state-of-the-art agents. This attack is possible due to the lack of security-focused memory governance. In response, we propose Agentic Memory Sentry (AM-Sentry), which leverages two mitigation techniques: a memory-saving policy and a memory-retrieval screen. Our experiments show that AM-Sentry dramatically reduces GhostWriter's success rate while preserving agent utility.

Figures

Figures reproduced from arXiv: 2607.06595 by George Torres, Satyajayant Misra, Sharad Shrestha.

Figure 1
Figure 1. Figure 1: Stateless LLM agents process each interaction in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: AI email assistant with persistent memory. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Two-phase memory injection attack: Phase 1 poisons the memory, which is retrieved and acted upon in Phase 2 [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Incoming content is evaluated before being admit [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: The retrieval screen blocks poisoned memories before they can enter an agent’s context. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: GhostWriter’s success results, broken down into memory injection (P1) success, attack retrieval success, and attack activation success (P2) [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: P2 activation rate (%) by category and separated by model and agent. [PITH_FULL_IMAGE:figures/full_fig_p010_7.png] view at source ↗
Figure 7
Figure 7. Figure 7: Prompt injection results against all of our evaluated [PITH_FULL_IMAGE:figures/full_fig_p011_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Memory Saving policy performance; shows the number of malicious memories admitted by each policy into the [PITH_FULL_IMAGE:figures/full_fig_p012_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: The total attack success rate for each policy configuration when paired with R. An attack is successful if it activates [PITH_FULL_IMAGE:figures/full_fig_p012_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Utility metrics for A-Mem showing the F1-similarity score, LLM judged scores, and tool accuracy across the [PITH_FULL_IMAGE:figures/full_fig_p013_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: A directive attack email that uses explicit instruc [PITH_FULL_IMAGE:figures/full_fig_p015_11.png] view at source ↗
Figure 15
Figure 15. Figure 15: A calendar event for a team lunch [PITH_FULL_IMAGE:figures/full_fig_p016_15.png] view at source ↗
Figure 13
Figure 13. Figure 13: An internal email from a colleague coordinating [PITH_FULL_IMAGE:figures/full_fig_p016_13.png] view at source ↗
Figure 16
Figure 16. Figure 16: A calendar update moving the date for a client [PITH_FULL_IMAGE:figures/full_fig_p016_16.png] view at source ↗
Figure 14
Figure 14. Figure 14: An email from a developer discussing imple [PITH_FULL_IMAGE:figures/full_fig_p016_14.png] view at source ↗
Figure 18
Figure 18. Figure 18: Utility metrics for Mem0, Letta, Expel, and MemoryOS. Showcasing the F1 similarity score, LLM judged scores, [PITH_FULL_IMAGE:figures/full_fig_p017_18.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response

    cs.AI 2026-07 conditional novelty 4.0

    A structured review organizes cyber-capable-agent risks into five vulnerability classes and argues that evaluation environments must be treated as operational security systems rather than background.

Reference graph

Works this paper leans on

38 extracted references · 10 linked inside Pith · cited by 1 Pith paper

  1. [1]

    Toolformer: Language models can teach themselves to use tools,

    T. Schick, J. Dwivedi-Yu, R. Dess `ı, R. Raileanu, M. Lomeli, E. Ham- bro, L. Zettlemoyer, N. Cancedda, and T. Scialom, “Toolformer: Language models can teach themselves to use tools,”Advances in neural information processing systems, vol. 36, pp. 68 539–68 551, 2023

    2023

  2. [2]

    A survey on large language model based autonomous agents,

    L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y . Linet al., “A survey on large language model based autonomous agents,”Frontiers of Computer Science, vol. 18, no. 6, p. 186345, 2024

    2024

  3. [3]

    MemGPT: towards LLMs as operating systems

    C. Packer, V . Fang, S. Patil, K. Lin, S. Wooders, and J. Gonzalez, “MemGPT: towards LLMs as operating systems.” 2023

    2023

  4. [4]

    Expel: Llm agents are experiential learners,

    A. Zhao, D. Huang, Q. Xu, M. Lin, Y .-J. Liu, and G. Huang, “Expel: Llm agents are experiential learners,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 38, no. 17, 2024, pp. 19 632–19 642

    2024

  5. [5]

    Memory os of ai agent,

    J. Kang, M. Ji, Z. Zhao, and T. Bai, “Memory os of ai agent,” in Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, 2025, pp. 25 972–25 981

    2025

  6. [6]

    Rap: Retrieval-augmented planning with contextual memory for multimodal llm agents,

    T. Kagaya, T. J. Yuan, Y . Lou, J. Karlekar, S. Pranata, A. Kinose, K. Oguri, F. Wick, and Y . You, “Rap: Retrieval-augmented planning with contextual memory for multimodal llm agents,”arXiv preprint arXiv:2402.03610, 2024

    Pith/arXiv arXiv 2024

  7. [7]

    GPT-4 Technical Report,

    OpenAI, “GPT-4 Technical Report,” 2024. [Online]. Available: https://arxiv.org/abs/2303.08774

    Pith/arXiv arXiv 2024

  8. [8]

    Introducing Devin, the first AI software engineer,

    S. Wu, “Introducing Devin, the first AI software engineer,” https: //cognition.ai/blog/introducing-devin, March 2024, cognition AI Blog. Accessed: 2025

    2024

  9. [9]

    Adaptive Memory Admission Control for LLM Agents,

    G. Zhang, W. Jiang, X. Wang, A. Behr, K. Zhao, J. Friedman, X. Chu, and A. Anoun, “Adaptive Memory Admission Control for LLM Agents,”arXiv preprint arXiv:2603.04549, 2026

    arXiv 2026

  10. [10]

    Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases,

    Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, “Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases,” Advances in Neural Information Processing Systems, vol. 37, pp. 130 185–130 213, 2024

    2024

  11. [11]

    Memory Injection Attacks on LLM Agents via Query-Only Interac- tion,

    S. Dong, S. Xu, P. He, Y . Li, J. Tang, T. Liu, H. Liu, and Z. Xiang, “Memory Injection Attacks on LLM Agents via Query-Only Interac- tion,”arXiv preprint arXiv:2503.03704, 2025

    arXiv 2025

  12. [12]

    Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,

    E. Debenedetti, J. Zhang, M. Balunovic, L. Beurer-Kellner, M. Fis- cher, and F. Tram`er, “Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,”Advances in Neural Information Processing Systems, vol. 37, pp. 82 895–82 920, 2024

    2024

  13. [13]

    Openagents: An open platform for language agents in the wild,

    T. Xie, F. Zhou, Z. Cheng, P. Shi, L. Weng, Y . Liu, T. J. Hua, J. Zhao, Q. Liu, C. Liuet al., “Openagents: An open platform for language agents in the wild,”arXiv preprint arXiv:2310.10634, 2023

    Pith/arXiv arXiv 2023

  14. [14]

    AutoGPT,

    Significant Gravitas, “AutoGPT,” https://github.com/Significant-Gra vitas/AutoGPT, 2023, accessed: 2026

    2023

  15. [15]

    BabyAGI,

    Y . Nakajima, “BabyAGI,” https://github.com/yoheinakajima/babyagi, 2023, accessed: 2026

    2023

  16. [16]

    React: Synergizing reasoning and acting in language models,

    S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. R. Narasimhan, and Y . Cao, “React: Synergizing reasoning and acting in language models,” inThe eleventh international conference on learning repre- sentations, 2022

    2022

  17. [17]

    Claude Model Card,

    Anthropic, “Claude Model Card,” https://www.anthropic.com/mode l-card, 2023, accessed: 2026

    2023

  18. [18]

    The rise and potential of large language model based agents: A survey,

    Z. Xi, W. Chen, X. Guo, W. He, Y . Ding, B. Hong, M. Zhang, J. Wang, S. Jin, E. Zhouet al., “The rise and potential of large language model based agents: A survey,”Science China Information Sciences, vol. 68, no. 2, p. 121101, 2025

    2025

  19. [19]

    Retrieval- augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K ¨uttler, M. Lewis, W.-t. Yih, T. Rockt ¨aschelet al., “Retrieval- augmented generation for knowledge-intensive nlp tasks,”Advances in neural information processing systems, vol. 33, pp. 9459–9474, 2020

    2020

  20. [20]

    Retrieval-augmented generation for large language models: A survey,

    Y . Gao, Y . Xiong, X. Gao, K. Jia, J. Pan, Y . Bi, Y . Dai, J. Sun, H. Wang, H. Wanget al., “Retrieval-augmented generation for large language models: A survey,”arXiv preprint arXiv:2312.10997, vol. 2, no. 1, p. 32, 2023

    Pith/arXiv arXiv 2023

  21. [21]

    Generative agents: Interactive simulacra of human behavior,

    J. S. Park, J. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, “Generative agents: Interactive simulacra of human behavior,” inProceedings of the 36th annual acm symposium on user interface software and technology, 2023, pp. 1–22

    2023

  22. [22]

    A-mem: Agentic memory for llm agents,

    W. Xu, Z. Liang, K. Mei, H. Gao, J. Tan, and Y . Zhang, “A-mem: Agentic memory for llm agents,”arXiv preprint arXiv:2502.12110, 2025

    Pith/arXiv arXiv 2025

  23. [23]

    Reflexion: Language agents with verbal reinforcement learning, 2023,

    N. Shinn, F. Cassano, E. Berman, A. Gopinath, K. Narasimhan, and S. Yao, “Reflexion: Language agents with verbal reinforcement learning, 2023,”URL https://arxiv.org/abs/2303.11366, vol. 8, 2024

    Pith/arXiv arXiv 2023

  24. [24]

    Hackers hijacked instagram accounts by tricking meta ai support chatbot into granting access,

    L. Franceschi-Bicchierai, “Hackers hijacked instagram accounts by tricking meta ai support chatbot into granting access,” Jun. 2026, accessed: 2026-06-05. [Online]. Available: https: //techcrunch.com/2026/06/01/hackers-hijacked-instagram-accounts-b y-tricking-meta-ai-support-chatbot-into-granting-access/

    2026

  25. [25]

    Zombie agents: Persistent control of self-evolving llm agents via self-reinforcing injections,

    X. Yang, Y . He, S. Ji, B. Hooi, and J. S. Dong, “Zombie agents: Persistent control of self-evolving llm agents via self-reinforcing injections,”arXiv preprint arXiv:2602.15654, 2026

    arXiv 2026

  26. [26]

    MemoryGraft: Persistent compromise of LLM agents via poisoned experience retrieval,

    S. S. Srivastava and H. He, “MemoryGraft: Persistent compromise of LLM agents via poisoned experience retrieval,”arXiv preprint arXiv:2512.16962, 2025

    arXiv 2025

  27. [27]

    A-memguard: A proactive defense framework for llm-based agent memory,

    Q. Wei, T. Yang, Y . Wang, X. Li, L. Li, Z. Yin, Y . Zhan, T. Holz, Z. Lin, and X. Wang, “A-memguard: A proactive defense framework for llm-based agent memory,”arXiv preprint arXiv:2510.02373, 2025

    arXiv 2025

  28. [28]

    The enron corpus: A new dataset for email classification research,

    B. Klimt and Y . Yang, “The enron corpus: A new dataset for email classification research,” inEuropean conference on machine learning. Springer, 2004, pp. 217–226

    2004

  29. [29]

    Sentence-bert: Sentence embeddings using siamese bert-networks,

    N. Reimers and I. Gurevych, “Sentence-bert: Sentence embeddings using siamese bert-networks,” 2019. [Online]. Available: https: //arxiv.org/abs/1908.10084

    Pith/arXiv arXiv 2019

  30. [30]

    C-pack: Packed resources for general chinese embeddings,

    S. Xiao, Z. Liu, P. Zhang, N. Muennighoff, D. Lian, and J.-Y . Nie, “C-pack: Packed resources for general chinese embeddings,” 2024. [Online]. Available: https://arxiv.org/abs/2309.07597

    Pith/arXiv arXiv 2024

  31. [31]

    Internet Crime Report 2023,

    FBI Internet Crime Complaint Center (IC3), “Internet Crime Report 2023,” 2024, accessed: 2026-04-26. [Online]. Available: https://www.ic3.gov/Media/PDF/AnnualReport/2023 IC3Report.pdf

    2023

  32. [32]

    Mem0: Building production-ready ai agents with scalable long-term mem- ory,

    P. Chhikara, D. Khant, S. Aryan, T. Singh, and D. Yadav, “Mem0: Building production-ready ai agents with scalable long-term mem- ory,”arXiv preprint arXiv:2504.19413, 2025

    Pith/arXiv arXiv 2025

  33. [33]

    Letta: Build and deploy stateful agents,

    Letta Team, “Letta: Build and deploy stateful agents,” https://github .com/letta-ai/letta, 2024, formerly MemGPT

    2024

  34. [34]

    Evaluating very long-term conversational memory of llm agents,

    A. Maharana, D.-H. Lee, S. Tulyakov, M. Bansal, F. Barbieri, and Y . Fang, “Evaluating very long-term conversational memory of llm agents,” inProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2024, pp. 13 851–13 870

    2024

  35. [35]

    HotpotQA: A dataset for diverse, explainable multi- hop question answering,

    Z. Yang, P. Qi, S. Zhang, Y . Bengio, W. Cohen, R. Salakhutdinov, and C. D. Manning, “HotpotQA: A dataset for diverse, explainable multi- hop question answering,” inProceedings of the 2018 conference on empirical methods in natural language processing, 2018, pp. 2369– 2380

    2018

  36. [36]

    Webshop: Towards scalable real-world web interaction with grounded language agents,

    S. Yao, H. Chen, J. Yang, and K. Narasimhan, “Webshop: Towards scalable real-world web interaction with grounded language agents,” Advances in Neural Information Processing Systems, vol. 35, pp. 20 744–20 757, 2022

    2022

  37. [37]

    Defending against prompt injection with datafilter,

    Y . Wang, S. Chen, R. Alkhudair, B. Alomair, and D. Wagner, “Defending against prompt injection with datafilter,”arXiv preprint arXiv:2510.19207, 2025

    arXiv 2025

  38. [38]

    Promptarmor: Sim- ple yet effective prompt injection defenses,

    T. Shi, K. Zhu, Z. Wang, Y . Jia, W. Cai, W. Liang, H. Wang, H. Alzahrani, J. Lu, K. Kawaguchiet al., “Promptarmor: Sim- ple yet effective prompt injection defenses,”arXiv preprint arXiv:2507.15219, 2025. Figure 11: A directive attack email that uses explicit instruc- tions and autocratic language. Appendix A. Ethical Considerations This paper studies sec...

    Pith/arXiv arXiv 2025