Agent State Attackdefensive reference

Publication ledger

Reference entries

Defensive definitions, state models, detection methods, control patterns, and mappings to established frameworks.

State Surfaces

7 min

Agent Plan Poisoning: When Injected Content Rewrites an Agent's Own Task List

Agent plan poisoning is SSA descriptive wording for injected content that rewrites an agent's own live task or plan object, adding, reordering, or completing steps the user never approved, so a later step executes with the authority the user granted the original plan. Covers the documented Auto-GPT indirect-injection CVEs and the AgentDojo benchmark, with detection and containment for agents that maintain a persistent, tool-visible task list.

Target: Plans & ArtifactsPersistence: Session to Cross-Session

State Surfaces

9 min

Agentic Browser Session Hijacking: Indirect Prompt Injection Into Authenticated Browser State

Agentic browser session hijacking is SSA descriptive wording for indirect prompt injection that reaches an AI browser's authenticated session state, cookies, and autofill data rather than the model's instructions alone. Covers the documented Brave disclosures against Perplexity Comet and Guardio Labs' Scamlexity report, with detection and containment for agents that hold login state a user never explicitly reviewed per action.

Target: Tool & Environment StatePersistence: Session to Cross-Session

State Surfaces

8 min

Sandbox Configuration Escape: How AI Coding Agents Turn Their Own Execution Environment into Persistent, Trusted State

Sandbox configuration escape is SSA descriptive wording for a write a compromised agent session makes to host-trusted configuration, session hooks, or CI/build cache state from inside its own sandbox, so the write survives the session boundary and runs with full host or pipeline privilege on the next launch. Covers CVE-2026-25725 in Claude Code, the Cymulate CBSE findings across Claude Code, Gemini CLI, and Codex CLI, and the Clinejection supply-chain compromise of Cline, with detection and containment that does not require abandoning sandboxed execution.

Target: Tool & Environment StatePersistence: Cross-Session to Shared-System

State Surfaces

9 min

RAG Poisoning: Security Risks When Retrieved Content Becomes an Agent's Context

RAG poisoning is SSA descriptive wording for adversarial content placed into a knowledge base, document store, or vector index so that retrieval loads it into an agent's live context as if it were trusted ground truth. Covers the documented PoisonedRAG attack methodology, the Slack AI and Microsoft 365 Copilot disclosures, and the Morris II worm, with detection and containment that does not require abandoning retrieval.

Target: ContextPersistence: Session to Shared-System

Defenses

14 min

Defending Agent State: A Cross-Surface Control Model for Prevention, Containment, and Recovery

A cross-surface control model for defending agent state: why input-filtering and perimeter controls do not protect a durable object that outlives the request that changed it, the Prevent, Contain, and Recover controls that recur across all six state surfaces documented on this site, and the failure modes that leave a defense program passing every audit while missing the incidents it was built for.

Target: MultiplePersistence: Multiple

Detection

13 min

Detecting Agent State Attacks: A Cross-Surface Telemetry and Signal Model

A cross-surface detection model for agent state attacks: four signal families (provenance mismatch, state-diff integrity, behavioral consequence, and cross-session propagation), the telemetry an agent needs before an incident, and the failure modes that make state-attack detection programs miss what they were built to catch.

Target: MultiplePersistence: Multiple

State Surfaces

9 min

MCP Tool Poisoning: Security Risks of Tool Descriptions, Tool Results, and Rug Pulls

MCP tool poisoning is SSA descriptive wording for adversarial content placed in tool descriptions, tool-call results, or post-approval tool definitions, so an agent treats hidden instructions as trusted metadata rather than untrusted input. Covers the documented Invariant Labs proofs of concept, the GitHub MCP issue exploit, and the postmark-mcp npm rug pull, with detection and containment that does not require disconnecting every server.

Target: Tool & Environment StatePersistence: Session to Cross-Session

State Surfaces

10 min

Shared State Poisoning in Multi-Agent Systems: Blackboards, Handoffs, and Session Smuggling

Shared state poisoning is SSA descriptive wording for adversarial writes to state that more than one agent or session reads as trusted: blackboard records, A2A handoff payloads, and shared memory. Covers the documented agent session smuggling technique, detection signals, and containment before one poisoned object compromises a whole agent network.

Target: Shared & Multi-Agent StatePersistence: Session to Shared-System

State Surfaces

10 min

Slopsquatting: Security Risks of Hallucinated Package Names in Agent-Generated Plans and Artifacts

Slopsquatting is SSA descriptive wording for the exploitation of a coding agent's own generated artifact, a dependency manifest, import statement, or install command referencing a package that does not exist, once an adversary pre-registers that predictable name on a public registry. Covers the documented package-hallucination research, the huggingface-cli proof of concept, and detection and containment that does not require banning agent-written dependency lists.

Target: Plans & ArtifactsPersistence: Cross-Session to Shared-System

State Surfaces

9 min

Instruction File Poisoning: Security Risks of CLAUDE.md, AGENTS.md, and Agent Configuration Files

Instruction file poisoning is SSA descriptive wording for adversarial content placed into a project configuration file an agent auto-loads as trusted, standing guidance: CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, and similar. Covers the documented Rules File Backdoor and TrapDoor campaigns, the Claude Code hooks CVEs, and containment that keeps repository-level customization useful.

Target: Goals & InstructionsPersistence: Cross-Session to Shared-System

State Surfaces

8 min

Persistent Memory Injection: Security Risks of AI Agent Memory-Write Tools

Persistent memory injection is SSA descriptive wording for adversarial content written into an agent's own long-term memory store through its memory-write tool, so it survives the session that created it and is read as trusted fact in every later one. Covers documented cases across ChatGPT, Gemini, and Claude, plus detection and containment that does not require disabling memory.

Target: Durable MemoryPersistence: Cross-Session

State Surfaces

11 min

Compromised Summaries and Context Compaction: Security Risks for AI Agents

What the security risks of context compaction are for AI agents: how compaction can preserve adversarial state while dropping valid constraints, what evidence to log, and how to prevent, contain, and recover from compromised summaries without publishing attack recipes.

Target: Context and Durable MemoryPersistence: Session to Cross-Session

Definitions

11 min

Agent State Attack: Definition, Scope, and Boundaries

The SSA working definition of an agent state attack, with boundaries around model-weight attacks, accidental behavioral state decay, ordinary invalid input, and the OS-layer self-state attacks defined in arXiv 2607.17986.

Target: MultiplePersistence: Single Turn to Shared-System