Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

May 18, 2026 | Source: arXiv AI

Tags: LLM security, memory poisoning, prompt injection, GPT-5.5, Kimi-K2, AI agents, adversarial attacks, AI safety

Researchers demonstrate a new attack class — sleeper memory poisoning — where adversarial content planted in documents or webpages causes LLM agents to store fabricated memories, with 99.8% write success on GPT-5.5 and 60–89% action hijack rates once memories are retrieved.

Details

As LLM assistants gain persistent memory — storing context across sessions for personalization — a critical new attack surface opens. Pulipaka et al. introduce sleeper memory poisoning: adversarial content embedded in a document, webpage, or code repository causes an agent to write a fabricated memory about the user. That memory then sits dormant and activates in future, unrelated sessions.\n\nThe paper evaluates the full attack pipeline across three stages: whether poisoned memories are written, whether they are later retrieved, and whether they successfully steer agentic actions. Results are alarming. On GPT-5.5, fabricated memories were written 99.8% of the time; on Kimi-K2.6, 95%. Among successful retrievals, poisoned memories caused attacker-intended agentic actions in 60–89% of cases across all tested models.\n\nWhat makes this particularly dangerous is the attack's persistence and stealth. Unlike conventional prompt injection — which is immediate and observable — sleeper attacks lie dormant and re-surface across multiple future conversations. The attack preserves overall model utility and bypasses existing geometry-based defenses, making detection difficult without dedicated memory validation layers.\n\nThe implications are direct for production AI deployments: persistent memory must be treated as a trust boundary. Memory writes from external content should be validated, sandboxed, or require explicit user confirmation. Teams deploying stateful agents — particularly those that process user-uploaded documents or browse the web — face a new class of persistent compromise.