Is it my preference? Role Grounding Attack against Agent's Memory via Social Interaction

Summary

Researchers formalize Role Grounding Attack (RGA), which exploits role-to-principal attribution flaws in LLM agent memory systems. An attacker-designed nested conversation, shared in an experience-sharing post, causes the victim agent to record the attacker's preference as its user's preference, and that misattributed preference persists into later retrieval and decisions. The authors instantiate RGA as tool selection manipulation and privacy leakage, reporting high attack success rates across five memory systems and six language models.

Related items

• InfoUnderstanding and Mitigating Role Spoofing in LLMsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-119050: Agno PandasTools unsafe reflection allows code execution via prompt injectionSimilar attack · NVD/CVE Database
• Low3 Ways AI Agents Already Operate in Your BrowserSimilar attack · BleepingComputer
• InfoAdversa AI Launches Coding Agent Security Platform to Block Cyberattacks on AI Agents in Real TimeSimilar attack · Adversa AI Blog
• InfoSEAL: Sealed Queries for Local Sanitization against Indirect Prompt InjectionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)