paperJune 2026Unreviewed

What If Prompt Injection Never Left? Exploring Cross-Session Stored Prompt Injection in Agentic Systems

Yuanbo Xie, Tianyun Liu, Yingjie Zhang, Suchen Liu, Yulin Li, Liya Su, Tingwen Liu

Abstract

Modern agentic systems transform LLMs from session-bounded assistants into stateful systems that persist and evolve shared world state across sessions through memories, filesystems, tools, and other long-lived contextual artifacts. This shift fundamentally expands the attack surface of prompt injection. However, prior works on prompt injection have largely focused on model-level threats within a single session, overlooking how cross-session persistent system state fundamentally changes the syste

Framework mappings

OWASP Top 10 for LLM Applications

LLM01Prompt Injection

MITRE ATLAS

AML.T0051LLM Prompt Injection

Suggested from the entry's categories.

Cite

@misc{xie2026what,
  title = {{What If Prompt Injection Never Left? Exploring Cross-Session Stored Prompt Injection in Agentic Systems}},
  author = {Yuanbo Xie and Tianyun Liu and Yingjie Zhang and Suchen Liu and Yulin Li and Liya Su and Tingwen Liu},
  year = {2026},
  month = jun,
  eprint = {2606.04425},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2606.04425}
}