Agent State Attackdefensive reference

Vendor-neutral field guide

Agent state can be attacked.

Start with what changes, how to detect it, and how to recover.

A defensive reference on attacks against agent context, memory, and goals.

Defensive scopeClassification, detection, mitigation, and recovery. No exploit recipes.

State surface map

What can be changed?

Runtime state sits between untrusted inputs and later decisions.

  1. 01ContextActive instructions and observations
  2. 02MemoryDurable state carried across decisions
  3. 03GoalsObjectives, constraints, and authority
  4. 04ToolsResults, environment state, and artifacts
  5. 05Shared stateInter-agent messages and common stores

Five-part index

Follow the problem from term to control.

View all pillars

P-01

Definitions

Stable terminology, scope, and boundaries between adjacent security concepts.

What is it, and what is it not?

P-02

State Surfaces

Context, memory, goals, plans, tool results, artifacts, and shared agent state.

What state can change, and through which boundary?

P-03

Detection

Signals, telemetry, evaluations, state diffs, provenance, and integrity checks.

How would we know the state was manipulated?

P-04

Defenses

Prevention, least privilege, containment, reset, revalidation, and recovery.

What prevents, limits, or reverses compromise?

P-05

Evidence & Mappings

Research, public incidents, standards, crosswalks, and adjacent disciplines.

Where is this observed, and how does it map?

Publication ledger

Latest reference entries

Full reference

State Surfaces

8 min

Embedding Inversion Attacks: How Attackers Reconstruct Private Text From an Agent's Vector-Store Memory

Embedding inversion is SSA descriptive wording for reconstructing the private text behind a stored vector embedding, the representation an agent's retrieval corpus or long-term memory is actually built from. Covers the documented Song and Raghunathan input-inversion attack, the Vec2Text reconstruction method, and the 2025 ALGEN and ZSInvert few-shot and zero-shot attacks, with detection and containment that does not require abandoning embedding-based memory.

Target: Durable MemoryPersistence: Cross-Session to Shared-System

State Surfaces

8 min

KV-Cache Prompt Leakage: Timing Side-Channel Attacks That Steal System Prompts From Shared LLM Caches

KV-cache prompt leakage is SSA descriptive wording for an attacker measuring response-time differences in a shared LLM serving cache to infer the content of a confidential system prompt or another tenant's private prompt, with no injection, no credential theft, and no error in any access-control check. Covers the documented PROMPTPEEK, Early Bird, and prompt-caching-audit research, and detection and containment that does not require disabling prompt caching.

Target: ContextPersistence: Session to Shared-System

State Surfaces

7 min

RAG Permission Bypass: When Retrieval Ignores Document-Level Access Control

RAG permission bypass is SSA descriptive wording for a retrieval-augmented pipeline serving content a querying user or session was never authorized to see, because the index flattened the source system's access control or the retrieval step never re-checked it. Covers the ConfusedPilot research's confused-deputy framing against Microsoft 365 Copilot and CVE-2026-21836, a 2026 broken-access-control flaw in HCL DominoIQ's RAG feature, with detection and containment that does not require disabling retrieval.

Target: Tool & Environment StatePersistence: Session to Shared-System

State Surfaces

9 min

AI Agent Clipboard Hijacking: ClickFix-Style Clipboard Poisoning Against Agentic Terminals and Browsers

Agent clipboard hijacking is SSA descriptive wording for the risk that the shared OS or browser clipboard, a channel built for a human to copy and paste, becomes attacker-controlled once an AI agent sits on either end of it. Covers the June 2026 GitHub advisory GHSA-wgqj-4c26-7c4g (CVE-2026-48725, CVSS 8.1 High), where Warp's agentic terminal let untrusted output read or write the local clipboard through OSC 52 with no confirmation step; MITRE ATLAS case study AML.CS0055, where a researcher got Anthropic's Claude Computer-Use agent to copy a malicious command to its own clipboard, paste it into a terminal, and run it; and the October 2025 report that OpenAI's Atlas browser agent could itself be tricked into overwriting a user's clipboard with a phishing link.

Target: Tool & Environment StatePersistence: Single Turn to Session

State Surfaces

8 min

Target-State Script Injection: Declarative Config and Infrastructure Tools as a Code-Execution Path for AI Agents

Target-state script injection is SSA descriptive wording for a declarative config or infrastructure-as-code tool executing attacker-controlled commands as the documented mechanism for reaching a declared target state, not as a bug in any one tool. Covers chezmoi's documented run_ and modify_ script model, the September 2026 Coder registry compromise that shipped credential-stealing Terraform modules through a data.external block (GHSA-vx42-ghc9-gw65), and the Miasma worm as evidence that AI coding agents already execute repo-shipped setup artifacts without per-file review.

Target: Tool & Environment StatePersistence: Cross-Session to Shared-System

State Surfaces

9 min

Agent Command-Approval Bypass: Shell Rewriting and Git Hooks Against AI Coding-Agent Guardrails

Agent command-approval bypass is SSA descriptive wording for a gap between what a coding agent's own guardrail inspects before approving a shell or git action and what the underlying interpreter actually runs. Covers the documented GuardFall research showing bash's own quote-removal and expansion defeat raw-string guards in 10 of 11 open-source coding agents, and two Cursor CVEs, CVE-2026-22708 and CVE-2026-26268, where an allowlist and a sandbox's write protection were each bypassed through a different mechanism, with detection and containment that does not require disabling agent-run commands.

Target: Tool & Environment StatePersistence: Single Turn to Cross-Session