The authors built CarryoverBench, comprising 101 attack tasks across 12 personal-assistant scenario families.
Persistent agent state lets prompt injections survive across sessions
CarryoverBench shows that malicious instructions stored in memory or scheduled tasks can execute repeatedly after the initial attack session ends.
Chinese Tech
Zhiyue Xu · Xukai Wang · Zhiyuan Huang · Mingjie Zhan · Jian Zhao · Xu-Yao Zhang
MAIS · Institute of Automation, Chinese Academy of Sciences · School of Artificial Intelligence, UCAS · Zhongguancun Academy · SenseTime Research
Research Digest··3 min read
Xu and colleagues benchmark a cross-session failure mode in which an LLM agent writes an attacker’s instruction into persistent state, then executes it during later sessions.
§