When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents
Shuhuai Huang, Jingfeng Zhang and Hong Jia (University of Auckland and Fudan University) present PMPA, an attack that hides instructions in ordinary external content so that a harness-based agent writes them into its own persistent memory, where they trigger malicious actions and privacy leaks in later sessions.
Ask this paper
Attack path: The attacker never touches the agent framework. The victim agent reads a poisoned external source during a normal task and stores the embedded instruction in persistent memory.
Cross-session effect: In later sessions the agent retrieves the poisoned memory and acts on it, which leaks private data and triggers additional actions the user did not request.
Results on real harnesses: Averaged over backbone models, input modalities and trigger scenarios, injection success and cross-session attack success are 73.7% and 55.5% on OpenClaw and 66.9% and 81.7% on Claude Code, with benign task performance unchanged.
Defense result: A targeted prompt-level defense reduces the rate at which instructions get written to memory in many settings, but gives limited protection once memory has already been poisoned.
Abstract
Harness design has transformed the development of LLM-based agents by integrating memory, tool use, and runtime control. However, this design also introduces security and privacy risks because malicious instructions from external sources may be written into persistent memory and persist across sessions. To study this risk, we propose PMPA, a Persistent Memory Poisoning Attack against harness-based agents. PMPA embeds malicious instructions into benign external sources and induces the victim agent to write them into persistent memory without directly accessing to the agent framework. Once stored, the poisoned memory can be retrieved in later sessions, triggering additional malicious actions and causing privacy leakage. We evaluate PMPA on OpenClaw and Claude Code across different backbone LLMs, input modalities, and trigger scenarios. Across all settings, PMPA achieves average Injection Success Rate (ISR) and Cross-session Attack Success Rate (C-ASR) of 73.7%/ 55.5% on OpenClaw and 66.9%/ 81.7% on Claude Code, while preserving benign task performance on both systems. We further evaluate a targeted prompt-level defense and find that it can reduce memory injection in many settings, but provides limited protection once the persistent memory has been poisoned.