Stored prompt injection: payloads hidden in agent memory fire later in clean sessions
Future_AGI · reddit · 2026-11-10
A Reddit post warns about stored prompt injection: an attacker plants an instruction that gets saved as an ordinary note in the agent's cross-session memory (Markdown files or knowledge graphs), never touching the victim's session. The next day, a clean session loads that memory as trusted context and executes the payload with whatever permissions are live.
- The irony: moving agent memory to plain-text files is popular right now, but it makes memory appendable by any tool call, with nothing re-reading it suspiciously after a reset.
- The author scripts red-team runs that plant a payload in one session and check whether any deny-listed tool fires in a later clean one; the kit is open source.
- Closing question for the community: if your agent keeps memory between sessions, what reviews what gets written into it?
More from coding & agent
- WorkflowArena: First Benchmark for Multi-Agent Workflow Orchestration With 145 Real-World Tasks — _akhaliq · 2026-11-10
- Klint 1.0 ships: AI-ported TS to Rust is 25x faster with 28x less memory — rchardkovacs · 2026-11-10
- Pi's Virtual Models auto-route queries between local Qwen and remote Kimi or GLM — ggerganov · 2026-11-10
- Unlimited-OCR-2 tested: parsing 30-page PDFs in one request without breaking tables — KhuyenTran16 · 2026-11-10
- Screaming Frog tip: your AI assistant can fully configure your SEO crawler — VeryWellVersed · 2026-11-10
- Managing agents like the infamous "plz deal" VP: dump context, give minimal direction — curious_vii · 2026-11-10