Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems

arXiv:2607.14611 · cs.CR, cs.AI, cs.MA · Submitted 2026-07-16 · Read on arXiv

Soham Gadgil, David Alexander, Sai Sunku, Franziska Roesner

cs.CR, cs.AI, cs.MA

Submitted: 2026-07-16

Comments: Preprint

Code: https://github.com/multica-ai/andrej-karpathy-

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Agentic System — 33× in this paper · explained in 2 episodes
• Core — 19× in this paper · explained in 2 episodes
• Agent Skills — 3× in this paper · explained in 1 episode
• Benchmark — 3× in this paper · explained in 2 episodes
• Provenance — 3× in this paper · explained in 4 episodes
• Adaptation — 2× in this paper · explained in 1 episode
• AI Agents — 1× in this paper · explained in 2 episodes
• Attack Success Rate (ASR) — 1× in this paper · explained in 2 episodes
• Benchmarking — 1× in this paper · explained in 3 episodes
• Large Language Model (LLM) — 1× in this paper · explained in 3 episodes

Sources

• Evaluating Large Language Models Trained on Code
• Memory in the Age of AI Agents
• Prompt Injection attack against LLM-integrated Applications
• Large Language Model Agent: A Survey on Methodology, Applications and Challenges
• The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections
• Ignore Previous Prompt: Attack Techniques For Language Models
• Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry
• From Recall to Forgetting: Benchmarking Long-Term Memory for Personalized Agents
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections
• ReAct: Synergizing Reasoning and Acting in Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs