Agent State Attackdefensive reference

Vendor-neutral field guide

Agent state can be attacked.

Start with what changes, how to detect it, and how to recover.

A defensive reference on attacks against agent context, memory, and goals.

Defensive scopeClassification, detection, mitigation, and recovery. No exploit recipes.

State surface map

What can be changed?

Runtime state sits between untrusted inputs and later decisions.

  1. 01ContextActive instructions and observations
  2. 02MemoryDurable state carried across decisions
  3. 03GoalsObjectives, constraints, and authority
  4. 04ToolsResults, environment state, and artifacts
  5. 05Shared stateInter-agent messages and common stores

Five-part index

Follow the problem from term to control.

View all pillars

P-01

Definitions

Stable terminology, scope, and boundaries between adjacent security concepts.

What is it, and what is it not?

P-02

State Surfaces

Context, memory, goals, plans, tool results, artifacts, and shared agent state.

What state can change, and through which boundary?

P-03

Detection

Signals, telemetry, evaluations, state diffs, provenance, and integrity checks.

How would we know the state was manipulated?

P-04

Defenses

Prevention, least privilege, containment, reset, revalidation, and recovery.

What prevents, limits, or reverses compromise?

P-05

Evidence & Mappings

Research, public incidents, standards, crosswalks, and adjacent disciplines.

Where is this observed, and how does it map?

Publication ledger

Latest reference entries

Full reference

State Surfaces

7 min

Agent Plan Poisoning: When Injected Content Rewrites an Agent's Own Task List

Agent plan poisoning is SSA descriptive wording for injected content that rewrites an agent's own live task or plan object, adding, reordering, or completing steps the user never approved, so a later step executes with the authority the user granted the original plan. Covers the documented Auto-GPT indirect-injection CVEs and the AgentDojo benchmark, with detection and containment for agents that maintain a persistent, tool-visible task list.

Target: Plans & ArtifactsPersistence: Session to Cross-Session

State Surfaces

9 min

Agentic Browser Session Hijacking: Indirect Prompt Injection Into Authenticated Browser State

Agentic browser session hijacking is SSA descriptive wording for indirect prompt injection that reaches an AI browser's authenticated session state, cookies, and autofill data rather than the model's instructions alone. Covers the documented Brave disclosures against Perplexity Comet and Guardio Labs' Scamlexity report, with detection and containment for agents that hold login state a user never explicitly reviewed per action.

Target: Tool & Environment StatePersistence: Session to Cross-Session

State Surfaces

8 min

Sandbox Configuration Escape: How AI Coding Agents Turn Their Own Execution Environment into Persistent, Trusted State

Sandbox configuration escape is SSA descriptive wording for a write a compromised agent session makes to host-trusted configuration, session hooks, or CI/build cache state from inside its own sandbox, so the write survives the session boundary and runs with full host or pipeline privilege on the next launch. Covers CVE-2026-25725 in Claude Code, the Cymulate CBSE findings across Claude Code, Gemini CLI, and Codex CLI, and the Clinejection supply-chain compromise of Cline, with detection and containment that does not require abandoning sandboxed execution.

Target: Tool & Environment StatePersistence: Cross-Session to Shared-System

State Surfaces

9 min

RAG Poisoning: Security Risks When Retrieved Content Becomes an Agent's Context

RAG poisoning is SSA descriptive wording for adversarial content placed into a knowledge base, document store, or vector index so that retrieval loads it into an agent's live context as if it were trusted ground truth. Covers the documented PoisonedRAG attack methodology, the Slack AI and Microsoft 365 Copilot disclosures, and the Morris II worm, with detection and containment that does not require abandoning retrieval.

Target: ContextPersistence: Session to Shared-System

Defenses

14 min

Defending Agent State: A Cross-Surface Control Model for Prevention, Containment, and Recovery

A cross-surface control model for defending agent state: why input-filtering and perimeter controls do not protect a durable object that outlives the request that changed it, the Prevent, Contain, and Recover controls that recur across all six state surfaces documented on this site, and the failure modes that leave a defense program passing every audit while missing the incidents it was built for.

Target: MultiplePersistence: Multiple

Detection

13 min

Detecting Agent State Attacks: A Cross-Surface Telemetry and Signal Model

A cross-surface detection model for agent state attacks: four signal families (provenance mismatch, state-diff integrity, behavioral consequence, and cross-session propagation), the telemetry an agent needs before an incident, and the failure modes that make state-attack detection programs miss what they were built to catch.

Target: MultiplePersistence: Multiple