After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents

Summary

The authors introduce CarryoverBench, a benchmark of 12 personal-assistant scenarios and 101 attack tasks that tests indirect prompt injections persisting through memory files and scheduled tasks across sessions. Across five frontier models, planted payloads re-fire without measurable decay over five rounds, and conditional on successful planting, the trigger stage often adds little protection. Porting the Latent channel to the Hermes runtime attenuates but does not eliminate the effect.

Mitigation

The source suggests that carryover defense requires runtime-layer controls in addition to prompt-level interventions.

Related items

• HighCVE-2026-114107: HKUDS Vibe-Trading indirect prompt injection enabling shell command executionSimilar attack · NVD/CVE Database
• InfoBuilding Trust into Enterprise AI Agents: Cisco AI Defense and Workday Agent PassportSimilar attack · Cisco AI Blog
• InfoMAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoContext-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAGSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoClawMMU: Protection-Coherent Virtual Memory for Stateful LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)