AI agents can save instructions from messages or webpages to use later. That creates a risk: malicious text can outlast its source and steer a future task. This is cross-session : hostile instructions planted in one session influence another.
MemHarmBench tests this by exposing agents to malicious content, removing it, then giving them an ordinary task while keeping their saved memory. It checks whether the agent follows the attack, completes the real task, and shows visible signs something went wrong, while tracking who could be harmed: users, project owners, or outsiders.
Across tested configurations, 55.71% of eligible episodes showed all three: the agent followed the attacker’s instruction, completed the legitimate task, and showed no visible anomaly. A normal-looking, finished task is therefore not proof that an agent’s decisions are safe.