Vendor-neutral field guide
Start with what changes, how to detect it, and how to recover.
A defensive reference on attacks against agent context, memory, and goals.
Defensive scopeClassification, detection, mitigation, and recovery. No exploit recipes.
State surface map
Runtime state sits between untrusted inputs and later decisions.
Five-part index
P-01
Stable terminology, scope, and boundaries between adjacent security concepts.
What is it, and what is it not?P-02
Context, memory, goals, plans, tool results, artifacts, and shared agent state.
What state can change, and through which boundary?P-03
Signals, telemetry, evaluations, state diffs, provenance, and integrity checks.
How would we know the state was manipulated?P-04
Prevention, least privilege, containment, reset, revalidation, and recovery.
What prevents, limits, or reverses compromise?P-05
Research, public incidents, standards, crosswalks, and adjacent disciplines.
Where is this observed, and how does it map?Publication ledger
A state-focused crosswalk of all ten OWASP Agentic Top 10 2026 risks against OWASP LLM Top 10 2025 risks and MITRE ATLAS v2026.06 techniques, with official identifiers, names, versions, and the boundaries that prevent false equivalence. The relationship labels are SSA editorial synthesis.
Target: MultiplePersistence: Multiple
What the security risks of context compaction are for AI agents: how compaction can preserve adversarial state while dropping valid constraints, what evidence to log, and how to prevent, contain, and recover from compromised summaries without publishing attack recipes.
Target: Context and Durable MemoryPersistence: Session to Cross-Session
The SSA working definition of an agent state attack, with boundaries around model-weight attacks, accidental behavioral state decay, ordinary invalid input, and the OS-layer self-state attacks defined in arXiv 2607.17986.
Target: MultiplePersistence: Single Turn to Shared-System