Stateful Cross-Session Injection: Attacks, Detection, and Session-Boundary Defenses

A research project about the agent-security question that only exists after the first session ends. Nearly every published prompt-injection evaluation is stateless: attack, observe, reset, repeat. Real deployments are stateful — agents carry memory, task lists, cached context, and tool credentials across sessions, which is precisely what makes them useful. This project builds the missing stateful evaluation harness: injected instructions that persist in agent state, measured across sessions for persistence, reactivation, and amplification, and evaluated against session-boundary defenses that validate or scrub state between runs. The deliverable is a lifecycle study of cross-session injection — how long injected state survives, when it reactivates, how it compounds — plus a defense evaluation on the published benchmarks extended into the stateful regime.

>Defensive research in isolated environments. All experiments run on synthetic state in sandboxed harnesses extended from published benchmarks (AgentDojo, SIREN). No real user state, no real agents’ production memory, no third-party services. The attack material is drawn from the peer-reviewed literature and used only as research fixtures; the project’s contribution is the stateful measurement and defense evaluation, not new attack tooling.

Who Is This For?

• MPhil/PhD students in security research wanting a thesis at the intersection of agent memory and attack persistence
• Agent-platform engineers building persistent memory who need evidence on what state validation must catch
• Security researchers studying malware-persistence analogies in AI systems
• Trust & safety teams designing session policies for deployed agents

Research Problem

Agent state that persists across sessions — memory entries, saved plans, cached summaries, task queues — is written by agent activity and read back in later sessions. If an injection plants instructions in that state, the attack survives the session in which it landed. Session fuzzing (AgentFuzz) is single-session by construction; memory-poisoning research covers memory read/write attacks but not the full tool-stream persistence lifecycle; verification defenses (VIGIL) operate within a session’s tool calls. The research problem: the cross-session lifecycle of injected instructions — persistence duration, reactivation conditions, amplification through compounding state, and effective boundary defenses — is unmeasured, because the evaluation infrastructure for stateful injection campaigns does not exist.

Why This Problem Matters

Persistence is what separates an incident from a chronic condition. A stateless injection is bounded by one session’s blast radius; stateful injection converts a transient compromise into standing capability — the injected instruction waits in state until its trigger condition appears, then acts with the agent’s accumulated credentials and context. Every serious agent product is currently shipping persistent memory; none of the published evaluations tell their builders whether their boundary handling (if any) stops a planted instruction from surviving. Measuring the lifecycle also tells defenders where intervention pays most: at write time, at session boundaries, or at read time — an allocation question that cannot be answered without the lifecycle data.

Threat Model and Assumptions

The attacker can plant content into agent-reachable state through the vectors the published suites provide: tool outputs, retrieved documents, and memory writes that flow from them — replayed from SIREN and InjecAgent-class material rather than authored anew. The attacker cannot directly write the state store, alter the agent’s code, or observe sessions they did not influence; persistence must be achieved through the agent’s own write behavior, which is the realistic threat shape for production systems. The defender controls the session boundary: it may inspect, tag, quarantine, or rewrite state between sessions, and may re-anchor the agent’s intent at session start. Three assumptions bound interpretation. First, the state model (key-value entries with provenance metadata, task lists, cached summaries) abstracts production memory systems; richer stores may shift lifecycle curves, which is why the state classes are measured separately rather than pooled. Second, reactivation triggers in the benchmark are explicit test conditions — real attackers’ triggers may be subtler, so measured reactivation rates are floor estimates. Third, benign state dynamics (natural accumulation, overwriting) are measured from the harness’s own benign runs; deployments with different usage rhythms will differ. The experiment answers the question these assumptions frame: within a realistic write-path threat model, how durable is planted state, and what does boundary control cost to remove it?

Research Gap

What existing research has demonstrated

AgentFuzz (USENIX Security 2025) established directed greybox fuzzing for detecting taint-style vulnerabilities in LLM agents — within a session. AgentPoison (NeurIPS 2024) demonstrated backdoor attacks via poisoning RAG knowledge bases and long-term memory, showing state-directed poisoning is feasible. The memory-poisoning attack-and-defense paper (arXiv 2026, supplementary — no peer-reviewed venue identified at planning time) demonstrated poisoning and defense on memory-based agents directly. VIGIL with SIREN (ACL 2026) established verify-before-commit for tool-stream injection within an execution. TheAgentCompany demonstrated long-horizon agent work, but for capability measurement, not attack persistence.

What remains insufficiently studied

Existing approaches focus primarily on within-session attacks or memory read/write attacks in isolation, leaving the cross-session lifecycle insufficiently evaluated: no published work builds a stateful harness where injections survive session resets and measures persistence duration, trigger-conditional reactivation, and amplification across repeated sessions; no work evaluates session-boundary defenses (state scrubbing, intent re-anchoring, provenance validation) against such campaigns; and the malware-security analogy — dormant planted state reactivating on triggers — has not been systematically investigated for agents. Defensible statement: prior work demonstrates state-directed poisoning and within-session injection, but persistence-across-sessions measurement and boundary-defense evaluation remain open.

What Existing Research Shows

• AgentFuzz (Liu et al., USENIX Security 2025) — automated detection of taint-style agent vulnerabilities via greybox fuzzing; defines the within-session attack-discovery ceiling this project extends beyond.
• AgentPoison (Chen et al., NeurIPS 2024) — backdooring agents by poisoning memory/RAG stores; establishes that state is a viable attack target.
• Memory poisoning attack and defense on memory-based LLM agents (arXiv 2601.05504, 2026 — supplementary evidence, no peer-reviewed venue identified at planning time) — direct memory poisoning plus a defense attempt; closest prior work, still not lifecycle-measured.
• VIGIL + SIREN (Lin et al., ACL 2026) — within-session verification defense and benchmark; supplies attack cases whose stateful extension this project builds.

What Remains Open

Four specifics. First, persistence measurement: how long does planted state survive defensive-irrelevant factors — do benign agent activities naturally overwrite or reinforce it? Second, reactivation: under which trigger conditions does dormant state cause harmful action, and how reliable is the trigger conditional execution? Third, amplification: does injected state compound — does an instruction planted in session one shape agent behavior in session five even without further attacker access? Fourth, defense: do session-boundary validations (state provenance checks, intent re-anchoring against the user’s actual request, provenance-tagged state quarantine) break persistence at acceptable utility cost, and which boundary placement (write-time, boundary-time, read-time) is most efficient? The literature contains no measurements for any of the four.

Research Question

> How do injected instructions persist, reactivate, and amplify across agent sessions — and can session-boundary defenses (state scrubbing, intent re-anchoring, provenance validation) break the persistence lifecycle without destroying legitimate agent memory?

Research Hypothesis

We hypothesize that (1) injected state persists indefinitely absent boundary defenses, because nothing in normal agent operation invalidates it; (2) reactivation is trigger-conditional and more reliable than the original injection success rate, because planted state skips the delivery step that within-session attacks must complete; and (3) a boundary defense combining provenance-tagged state quarantine with intent re-anchoring blocks most reactivation while losing only a small, measurable fraction of legitimate persistent-memory utility.

Existing Research

• Liu et al., “Make Agent Defeat Agent: Automatic Detection of Taint-style Vulnerabilities in LLM-based Agents” (AgentFuzz), USENIX Security 2025. Official page: https://www.usenix.org/conference/usenixsecurity25/presentation/liu-fengyu
• Chen et al., “AgentPoison: Red-teaming LLM Agents via Poisoning Memory or RAG Knowledge Bases,” NeurIPS 2024. Official page: https://neurips.cc/virtual/2024/poster/94715
• Lin et al., “VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit” (with SIREN), ACL 2026. Preprint: https://arxiv.org/abs/2601.05755 (ACL 2026 long paper, DOI 10.18653/v1/2026.acl-long.443)
• Sunil et al., “Memory Poisoning Attack and Defense on Memory-Based LLM Agents,” arXiv 2026 — supplementary evidence (no peer-reviewed venue identified at planning time): https://arxiv.org/abs/2601.05504

Proposed Research Direction

The investigation proceeds in three movements. (1) Stateful harness construction. Extend two published harnesses (AgentDojo tasks; SIREN cases) with a session model: persistent state store (task lists, memory entries, cached summaries), session reset semantics, and state provenance logging (which session, which source, wrote each entry). Replay published injection cases so that their payloads target the state store; log every state transition. (2) Lifecycle measurement. For each injected state item, measure across N sessions: survival (present? effective?), reactivation rate when trigger conditions are presented, amplification (does the agent reference or act on planted state unprompted?), and interference with benign tasks. Produce lifecycle curves per state class (memory entries vs task lists vs cached summaries). (3) Defense evaluation. Implement three boundary defenses: state scrubbing (provenance-based quarantine of untagged/foreign-tagged entries), intent re-anchoring (at session start, re-derive the user’s intent and validate state against it), and read-time filtering (state entries must pass a check before influencing actions). Measure each defense’s effect on the lifecycle curves and on benign memory utility. Model choices: one open-weights agent model held constant; state store kept simple (documented key-value with metadata) so the science is the lifecycle, not storage engineering.

MPhil Scope

A bounded 6–12 month version: build the stateful extension on one harness (AgentDojo + SIREN replay), run the lifecycle measurement for two state classes across ten sessions per condition, and evaluate two boundary defenses (scrubbing and re-anchoring) against the no-defense baseline. Deliverables: the stateful harness, lifecycle curves, defense evaluation, and released infrastructure. One focused contribution: the first quantified cross-session injection lifecycle with boundary-defense comparison.

PhD Extension

The doctoral program generalizes the lifecycle into theory and harder regimes. Adaptive persistence: attackers who write state designed to survive specific boundary defenses, with a defense-evolution loop — measuring where the write-time/boundary-time/read-time equilibrium settles. Formal persistence model: define state-taint propagation formally (a taint-tracking semantics for agent memory) and prove or measure boundary-defense coverage against defined attack grammars. Multi-user isolation: extend to shared agent state where one user’s session can poison another’s context — the cross-tenant isolation question production platforms face. Longitudinal field study: instrument a real agent framework (locally hosted, synthetic data) over months of use to compare laboratory lifecycle curves against organic usage.

Dataset / Benchmark

• AgentDojo — the base harness for tasks, agent loop, and benign-trajectory generation (https://agentdojo.spylab.ai/, https://github.com/ethz-spylab/agentdojo). Relevance: the stateful extension builds directly on its task/attack structure, keeping results comparable to the within-session literature. Suitable for MPhil: yes.
• SIREN (with VIGIL) — 959 tool-stream injection cases providing the attack payloads to replay statefully (code via https://arxiv.org/abs/2601.05755, ACL 2026). Relevance: published, peer-reviewed attack material — the project replays rather than invents. Suitable for MPhil: yes.
• AgentPoison (NeurIPS 2024) — memory-poisoning methodology informing the state-poisoning design (https://neurips.cc/virtual/2024/poster/94715). Relevance: connects the tool-stream and memory research lines. Suitable for MPhil: yes, as design reference.
• The session model and state-provenance store are this project’s infrastructure contribution; no new benchmark scores or dataset sizes are asserted.

Baseline Methods

• No-defense baseline — the full lifecycle curves every defense is measured against.
• Within-session VIGIL-style verification — the published defense, expected to underperform in the stateful regime because its verification scope is per-execution.
• Simple state reset — clearing all state at session boundaries; the naive defense whose utility cost motivates smarter boundaries.
• Memory-scrubbing baseline — keyword/rule-based state cleaning, representing current ad-hoc practice.

Evaluation Metrics

• Persistence rate — fraction of injected state items surviving N sessions.
• Reactivation success rate — fraction of dormant items causing harmful action when triggers are presented.
• Amplification factor — benign-session actions influenced by planted state, per session index.
• Defense block rate on injected state at each boundary type.
• Benign utility loss — legitimate memory/task-list functionality lost per defense, measured on benign task suites.
• Boundary cost — added latency/tokens per session start.

Experimental Design

Environment/dataset: stateful AgentDojo extension; SIREN payload replay; frozen open-weights agent model. Baseline: no-defense; VIGIL-style verification; naive reset; keyword scrubbing. Proposed method: provenance-quarantine and intent re-anchoring boundary defenses. Attack/test conditions: published injection payloads planted via their original vectors, targeting the state store; trigger presentation in designated sessions. Control conditions: benign-only sessions (state growth without attacks — establishes natural state dynamics); re-run of within-session attacks (validating that the extension reproduces known within-session results before stateful claims). Metrics: as above. Ablations: defense components (quarantine without re-anchoring; re-anchoring without provenance); state-class ablation (memory vs task lists vs summaries). Generalization tests: second harness (SIREN-native loop) for the lifecycle conclusions; one additional state class if time permits.

Expected Research Contribution

A potential contribution includes: the first cross-session injection lifecycle measurement (persistence, reactivation, amplification curves on published attacks); a stateful evaluation harness filling the stateless-evaluation gap in the literature; a defense evaluation of session-boundary mechanisms with utility accounting; and the analogy-mapping between classical malware persistence and agent-state persistence as a structured empirical study. Results may show defenses succeed, partially succeed, or fail — the lifecycle measurement is the contribution either way.

Limitations

The state model is deliberately simple; production memory systems (vector stores with retrieval weighting, hierarchical summaries) may behave differently, and lifecycle conclusions are claims about the modeled state classes. Session counts are bounded by compute; rare long-horizon reactivation may be underestimated. Attack payloads come from published suites — a bespoke attacker crafting state-native payloads from scratch could exceed the measured bounds (the PhD extension addresses adaptive persistence). The user-intent re-anchoring defense depends on intent being expressible and checkable at session start; ambiguous-intent workflows may stress it in ways the benchmark tasks do not. Amplification measurement depends on judging “influenced by planted state,” which is labeled by rubric and carries annotation uncertainty.

Research Ethics and Safety

All experiments use synthetic state in sandboxed, locally-run harnesses extended from published benchmarks; attack material is replayed from peer-reviewed suites, not authored. No real user memory, no production agents, no third-party services. The stateful harness is released for defensive research; nothing in the release functions as operational attack tooling beyond what the source benchmarks already publish. The research objective is defensive: giving agent-platform builders the lifecycle evidence needed to design boundary defenses before stateful injection incidents occur in the wild.

Prerequisites

• Python; comfort extending an existing benchmark harness
• Agent/tool-calling concepts and prompt-injection fundamentals
• Basic database/state-store handling (key-value with metadata)
• Experimental design (longitudinal measurement, controlled comparisons)
• Statistics for survival/reaction-rate analysis; Git

Suggested Research Timeline

• Phase 1 — Literature & design lock (weeks 1–4): state model, provenance schema, metrics definitions.
• Phase 2 — Harness construction (weeks 5–9): session model, state store, replay plumbing, validation against within-session baselines.
• Phase 3 — Lifecycle measurement (weeks 10–17): injected-state conditions across sessions; lifecycle curves.
• Phase 4 — Defense implementation (weeks 18–22): boundary defenses built and instrumented.
• Phase 5 — Defense evaluation (weeks 23–27): lifecycle curves under each defense; utility accounting.
• Phase 6 — Ablations & generalization (weeks 28–30): component ablations; second harness.
• Phase 7 — Analysis & write-up (weeks 31–34): thesis/paper; harness release.

Related Ideas

• Reproducible Benchmark Harness for Desktop AI Agents — the harness-building discipline this project extends into the stateful regime.
• Zero-Knowledge Encrypted Notes App — persistent-state product thinking on the site, for contrast on state governance.
• Health Data Aggregator Across Wearables — longitudinal state aggregation with privacy boundaries, a product analogue to lifecycle measurement.