Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents

arXiv:2609.35576 · cs.AI, cs.CL, cs.CR, cs.LG · Submitted 2026-09-28 · Read on arXiv

cs.AI, cs.CL, cs.CR, cs.LG

Submitted: 2026-09-28

Updated: 2026-09-28

Code: https://github.com/openai/codex

Terminology

• Agent Memory — 5× in this paper · explained in 1 episode
• Benchmark — 5× in this paper · explained in 2 episodes
• Benchmarking — 4× in this paper · explained in 4 episodes
• RAG — 4× in this paper · explained in 3 episodes
• Clustering — 3× in this paper · explained in 2 episodes
• Verification — 3× in this paper · explained in 2 episodes
• Agentic System — 2× in this paper · explained in 2 episodes
• Alignment — 2× in this paper · explained in 1 episode
• Multi-Agent System — 2× in this paper · explained in 6 episodes
• Provenance — 2× in this paper · explained in 4 episodes
• Trace — 2× in this paper · explained in 2 episodes
• Adam — 1× in this paper · explained in 2 episodes
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Adversarial Training — 1× in this paper · explained in 1 episode
• Failure Modes — 1× in this paper · explained in 3 episodes
• Fidelity — 1× in this paper · explained in 2 episodes
• Generalization — 1× in this paper · explained in 13 episodes
• LLM judge — 1× in this paper · explained in 2 episodes
• Large Language Model (LLM) — 1× in this paper · explained in 3 episodes
• Redundancy — 1× in this paper · explained in 2 episodes
• Robustness — 1× in this paper · explained in 5 episodes
• Steering — 1× in this paper · explained in 2 episodes

Sources

• MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair
• From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
• DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence
• Memory Injection Attacks on LLM Agents via Query-Only Interaction
• WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks
• MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents
• Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
• gpt-oss-120b & gpt-oss-20b Model Card
• MemGPT: Towards LLMs as Operating Systems
• Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems
• MURMUR: Using cross-user chatter to break collaborative language agents in groups
• Hidden in Memory: Sleeper Memory Poisoning in LLM Agents
• MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval
• EVOMAL: Self-Poisoning in Self-Evolving Coding Agents
• What If Prompt Injection Never Left? Rethinking Agent Security through Cross-Session Stored Prompt Injection
• No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections
• Prompt Injection as Role Confusion
• Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense

Related papers

• MAVEN-T: Reinforced Heterogeneous Distillation for Real-Time Multi-Agent Trajectory Prediction
• Model Discovery Agent: LLM-assisted Bayesian experiment design for data-efficient discovery of mechanistic world models
• The Clinician's Veto: Navigating Trust, Liability, and Uncertainty in Autonomous AI Prescribing
• MindHelper: Closed-Loop Embodied Mental-State Reasoning for Precision Intervention
• Incumbent Advantage: Brand Bias and Cognitive Manipulation Dynamics in LLM Recommendation Systems
• VSAL: A Vision Solver with Adaptive Layouts for Graph Property Detection