When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents

Abstract

Harness design has transformed the development of LLM-based agents by integrating memory, tool use, and runtime control. However, this design also introduces security and privacy risks because malicious instructions from external sources may be written into persistent memory and persist across sessions. To study this risk, we propose PMPA, a Persistent Memory Poisoning Attack against harness-based agents. PMPA embeds malicious instructions into benign external sources and induces the victim agen

Categories

Framework mappings

Suggested from the entry's categories.

@misc{huang2026whenb,
  title = {{When Malicious Instructions Persist: Persistent Memory Poisoning Attack on Harness-Based Agents}},
  author = {Shuhuai Huang and Jingfeng Zhang and Hong Jia},
  year = {2026},
  month = sep,
  eprint = {2609.13889},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.13889}
}