持久记忆让智能体易受指令注入攻击，恶意代码可长期潜伏并影响行为。
Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems
- 在沙盒环境中测试记忆型智能体的指令注入风险
- 已有恶意指令可跨会话持续生效，成功率因系统和模型而异
- 适合关注AI安全与代理系统防护的研究者阅读
越来越多的智能体系统通过记忆文件、行为偏好和知识库在会话间保持持久状态。这虽提升了智能体的实用性与自我改进能力，但也带来了新的提示注入攻击面：恶意指令可嵌入持久化文件中，影响未来行为。本文在沙盒合成工作区中研究基于记忆的智能体系统的提示注入攻击，评估了Anthropic Claude Code与OpenAI Codex两个系统，涵盖Claude Haiku 4.5、Claude Opus 4.7、GPT-5.2和GPT-5.5四个模型。结果显示，尽管难以通过外部不可信内容覆盖自身记忆文件，但已植入的恶意载荷能成功影响当前及后续会话。攻击成功率与载荷持久性在不同系统、模型、对抗目标及多会话攻击序列中差异显著。这些发现表明，持久记忆改变了提示注入的威胁模型，亟需在保留智能体自适应能力的前提下，防御内存更新环节的安全风险。
原文摘要 · Abstract (English)
A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases. While this makes agents more useful and self-improving, it also creates a new attack surface for prompt injections in which malicious instructions can be embedded within persistent files and influence future behavior. In this work, we study prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace. We evaluate two agentic systems, Anthropic Claude Code and OpenAI Codex, across four models: Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. Our results show that although it is difficult to make an agent overwrite its own memory files using untrusted external content, payloads already planted in those files can successfully attack current and future sessions. Attack success and payload persistence vary substantially across systems, models, adversarial goals, and multi-session attack sequences. These findings show that persistent memory changes the threat model for prompt injection and motivate defenses that protect memory updates without removing useful agent adaptation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。