About this reference
A defensive record of what changes, where it persists, and how to respond.
Agent State Attack is a vendor-neutral reference on adversarial changes to the context, memory, goals, and shared state that guide AI agents.
Working definition
An agent state attack is a deliberate attempt to alter, contaminate, suppress, or exploit the runtime state that governs an AI agent's later decisions. The target may include context, memory, goals, plans, tool results, or shared state, without requiring any change to the model's weights.
This is an SSA working definition, not a term attributed to an established standard. If a more authoritative definition emerges, this reference will document the difference and revise the wording with a visible change history.
Defensive scope
Classification, detection, mitigation, containment, and recovery. No exploit recipes. The reference describes trust boundaries, state transitions, observable signals, and defensive controls at an abstract level.
It does not publish executable attack payloads, product-specific bypass sequences, credential-theft instructions, or operational details that would raise the likelihood of successful misuse. Public incidents are reduced to the affected state, failed control, observable evidence, and defensive lesson.
How the material is organized
Definitions fixes terminology and boundaries.State Surfaces traces what can be changed and through which write path.Detection covers signals, telemetry, and evaluation.Defenses covers prevention, containment, and recovery.Evidence & Mappings connects research, incidents, and established frameworks without presenting this site as their replacement.
Sister reference
Behavioral State Decay documents non-adversarial drift and degradation in long-running AI agents. Agent State Attack owns the intentional-cause and state-compromise side of the boundary; Behavioral State Decay owns the later behavioral trajectory and reliability measurement side.
The same visible degradation can have different causes. Accidental summary loss or accumulated context rot belongs to the reliability reference. A deliberate attempt to induce the same state change belongs here.
Disambiguation: “self-state attacks”
The July 2026 paperSelf-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?uses self-state attacks for compromise of a self-hosted agent's own memory and configuration files through legitimate operating-system calls, and studies the limits of OS-level prevention, detection, and recovery.
That OS-layer research concept is related but distinct. This site usesagent state attack as a broader application and runtime-state working term spanning context, memory, goals, plans, tool results, and shared state. Agent State Attack does not rename or claim the paper's term.