Agent Scheduled-Task Poisoning: How Sleeper Channels Turn Cron Jobs Into Standing Backdoors

Agent scheduled-task poisoning is SSA descriptive wording for a security-relevant write to the scheduling state an always-on agent uses to run work without a user present: a cron entry, a heartbeat-triggered job, or an OS-level scheduled task the agent itself creates. The defining mechanism is what a May 2026 academic paper named a sleeper channel: untrusted input arrives through one surface, a chat message, a forwarded email, a page the agent summarizes, and persists as a scheduled job rather than acting immediately, then fires later through a different surface, a shell command, a messaging send, a file write, with no attacker present at the moment it executes. A real, fixed vulnerability in OpenClaw, one of the fastest-growing always-on agent frameworks, shows the same entry path producing an authenticated command-injection primitive in the code that generates the scheduled task itself.

What it is

The defining object is the scheduling state an always-on agent process maintains so it can act on a delay or on a recurring interval: a cron line, a heartbeat-daemon job queue entry, or a platform scheduled-task record. The defining cause is content the agent never required a human to re-approve at the moment the job fires, either because the original instruction that created the job came from untrusted input the agent treated as a legitimate request, or because the job-creation code itself failed to neutralize attacker-influenced values before writing them into a script the scheduler later executes. The defining consequence is a split between when the attacker's content entered the system and when it takes effect, which breaks the usual assumption that a security review of "what just happened" also covers "what was just scheduled to happen."

Two documented failure modes sit under this same object. The first is instruction-level: an agent's own scheduling tool is invoked on the strength of untrusted content, so the job itself encodes an attacker's goal. The second is code-level: the mechanism that turns a scheduling request into a platform artifact, a .cmd file registered with Windows Task Scheduler, a crontab line, mishandles the characters inside that request, so the job's text becomes a command-injection primitive regardless of whether the original instruction was malicious.

What it is not

Agent plan poisoning, where injected content rewrites the live, in-session task list an agent re-reads on its next turn. That object disappears with the session or the next re-plan. A scheduled job is a separate, OS- or scheduler-level artifact that keeps firing on its own clock whether or not any session is open.
Agent checkpoint poisoning, where a poisoned serialized state object triggers code execution the instant a later session deserializes it. A scheduled job needs no deserialization step and no resumed session; the scheduler itself is the trigger.
Persistent memory injection, the broader pattern of untrusted content causing a memory-write call. A scheduled job is a distinct persistence substrate from a memory record, with its own firing mechanism (a scheduler daemon or OS task runner) rather than a later context-read.
Ordinary, correctly scoped use of an agent's scheduling feature, where a user directly and knowingly asks for a recurring reminder or job. The failure is the missing re-approval step between a job's creation and its execution, not the feature itself.
Reproducible payload strings for the Windows Task Scheduler command-injection flaw described below.

Target state, trust boundary, and persistence

The target state is the scheduling record itself, plus whatever the fired job can reach: a shell, a messaging channel, a filesystem, or another tool the always-on agent process holds standing credentials for. The trust boundary that fails is the assumption that a review of the agent's current conversation or current task list is a complete security review. A sleeper channel defeats that assumption by design: the compromise is latent in scheduler state that no conversational review surfaces, and it activates on a clock an attacker does not need to be present for.

Persistence here is cross-session by construction, which is the entire reason an attacker would choose this entry path over a transient prompt-injection response. A cron line or a registered Windows scheduled task survives the chat session that created it, survives a restart of the agent process if the scheduler itself is OS-managed rather than in-memory, and keeps firing on its configured interval until something removes the entry. This is a materially different persistence profile from a poisoned response the model gives once; the job is a standing, re-triggering artifact, not a one-time output.

What the research establishes

"Sleeper Channels and Provenance Gates: Persistent Prompt Injection in Always-on Autonomous AI Agents," by Narek Maloyan and Dmitry Namiot, submitted May 13, 2026, is the paper that names and formalizes this pattern. It studies always-on agents, specifically OpenClaw and Hermes Agent, that run as a single long-lived process under one owner identity, folding messaging, memory, self-authored skills, scheduling, and shell execution into one authority boundary. The paper defines a sleeper channel along two axes: the persistence substrate where untrusted content is parked, memory, a self-authored skill, a scheduled job, or a filesystem patch, and the firing-separation between the surface that received the input and the surface that later executes it. Its worked example walks through a confused-deputy cron attack against OpenClaw, demonstrating concretely how a scheduled job becomes the delivery mechanism. The paper's proposed defense, Provenance Gates, is tiered into three levels (D1 through D3); its middle tier, D2, keys a canonical action-instance digest to one-shot owner attestations, which the authors argue defeats paraphrase laundering, cross-input grant reuse, and replay of a previously approved job. The companion artifact implements a runtime adapter realizing five of ten defined mediation hooks specifically around the cron execution path, verified with 42 tests, published at github.com/maloyan/sleeper-channels (arXiv:2605.13471). Five of ten hooks implemented is a research prototype's coverage, not a production-ready claim; the paper's own scope is the cron path specifically, not every persistence substrate it names.

Independent of that research, a real, fixed vulnerability shows the code-level variant of this entry path in a shipped product. CVE-2026-31994 (GitHub Security Advisory GHSA-mqr9-vqhq-3jxw) describes a local command-injection flaw in OpenClaw's Windows scheduled-task script generation, caused by unsafe handling of cmd metacharacters and CR/LF sequences when the framework writes a gateway.cmd file for Windows Task Scheduler to run. A value containing metacharacters such as &, |, ^, or environment-variable expansion sequences, or a value containing a bare CR/LF sequence, can inject arbitrary commands into the generated script, which then executes with whatever privilege the scheduled task runs under. The flaw is classified under CWE-78, carries a CVSS v4.0 base score of 6.9, was published March 2026, and affects all OpenClaw versions through 2026.2.18, fixed in 2026.2.19 (CVE Record; fix commit). OpenClaw itself, formerly released as Clawdbot, is an open-source always-on agent framework that runs a persistent "Gateway" process on hardware the owner controls and reaches it through messaging platforms including Telegram, Discord, and Slack; its scheduling feature is a documented, intended capability, which is exactly the surface this CVE and the Sleeper Channels paper both examine.

These two sources establish different things and should not be conflated. The CVE is a specific, patched code defect in one project's script-generation logic. The Sleeper Channels paper is a general formalization of why scheduled-job persistence is a structural risk for any always-on agent architecture, independent of any single implementation bug, and situates it within the broader "promptware" kill chain formalized by Oleg Brodt, Elad Feldman, Bruce Schneier, and Ben Nassi in February 2026, which names Persistence, described there in terms of memory and retrieval poisoning, as the fourth of seven stages a multi-stage prompt-injection attack can traverse (arXiv:2601.09625). The Sleeper Channels paper extends that stage with a formal model specific to scheduled jobs and cron, a persistence substrate the kill-chain paper's own examples do not individually name.

Detection: observable signs

A scheduled job, cron entry, or recurring task exists that no user directly and knowingly created in that session, or whose creation cannot be traced to an explicit, reviewed user request.
A scheduled job's command or payload content does not match what the agent reported creating, or contains characters, encodings, or structure inconsistent with the stated purpose of the job.
A scheduled job fires and takes an action, a shell command, a message send, a file write, with no corresponding live session or user present at the time it ran.
A scheduled task's underlying script file shows signs of unescaped user- or content-controlled values, such as unexpected metacharacters or control characters in a generated .cmd, .sh, or crontab entry.
The set of active scheduled jobs grows or changes between audits with no corresponding record of a user request.

Defenses, containment, and recovery

The table below is SSA editorial guidance for defenders. It is neither a standard requirement nor a measured effectiveness ranking.

Control	Transition it interrupts	Applicability	Residual risk and verification
Require explicit, re-presented owner confirmation before a scheduling tool call commits a job, separate from the instruction that proposed it	Untrusted content silently becoming a standing scheduled job	Any always-on agent whose scheduling capability can be invoked on the strength of chat, email, or retrieved-page content	Confirmation only helps if what is shown matches what gets scheduled; verify the confirmation text and the committed job body are the same string.
Neutralize or reject shell metacharacters, CR/LF sequences, and environment-expansion characters when generating any scheduler script from dynamic input	Scheduling-tool input becoming a command-injection primitive in the generated script, as in CVE-2026-31994	Any code path that writes a cron line, `.cmd` file, or platform task definition from values not fully controlled by the implementation	Patches this specific class of defect; does not address a scheduling tool legitimately asked to do something harmful with syntactically clean input.
Periodically enumerate and diff all active scheduled jobs against a last-known-good, reviewed baseline	A sleeper-channel job persisting undetected between sessions	Any deployment where scheduled jobs are not already surfaced in every session's working context	Catches persistence but not intent; a newly appearing job still needs human review to judge whether it is malicious.
Scope the privilege a scheduled job executes under to the minimum the stated task needs, separate from the owner's full interactive privilege	Standing backdoor access once a malicious job fires	Deployments where the scheduler can be configured to run jobs under a restricted account or sandboxed context	Reduces blast radius; does not prevent the job from firing or detect that it is malicious.
Adopt tiered provenance gating on the scheduling path, per the Sleeper Channels paper's D1 through D3 model, keying commitment to canonical action digests and one-shot owner attestations	Paraphrase laundering, cross-input grant reuse, and replay of a previously approved job	Deployments able to adopt a research-stage defense; the published artifact covers five of ten defined mediation hooks around the cron path specifically	A research prototype's coverage, not a vetted production control; retest against your own scheduling implementation before relying on it.

Prevention should require a re-presented, separate confirmation step before any scheduling tool call commits, and should neutralize the same class of unescaped metacharacters and control characters that CVE-2026-31994 shows reaching a generated script. Detection should enumerate and diff active scheduled jobs on a cadence independent of any single session, since the whole point of this entry path is that a session review will not surface it. Containment should remove the specific job and revoke whatever credential or tool access it held, not assume removing the triggering conversation is sufficient. Recovery should audit every action the job already took before discovery, since a fired job produces no conversational reasoning trace the way a live chat turn does.

Boundaries with similar concepts

This differs from agent plan poisoning in persistence substrate and firing mechanism. Plan poisoning changes an in-session task list the agent re-reads on its own next turn; the object and its re-trigger both live inside one conversational thread. Agent scheduled-task poisoning writes to a separate, often OS-level scheduler that fires independent of any open session, which is precisely the firing-separation the Sleeper Channels paper uses to define the broader sleeper-channel class.

This also differs from agent checkpoint poisoning in trigger condition. A poisoned checkpoint requires a later session to deserialize it before anything executes. A poisoned scheduled job requires no session at all; the scheduler daemon or OS task runner is its own trigger, which is why its persistence profile and detection approach both differ from a resume-triggered attack.

Mapping to standards and research

Source	Source-owned term or item	Relationship to this article
Maloyan & Namiot, arXiv (2026-05-13)	Sleeper Channels; Provenance Gates (D1–D3)	Primary-source origin of the persistence-substrate/firing-separation model and the proposed defense this entry describes.
GitHub Security Advisory / CVE Program	CVE-2026-31994; GHSA-mqr9-vqhq-3jxw	Primary-source evidence of a real, patched command-injection defect in a shipped always-on agent's scheduled-task generation code.
Brodt, Feldman, Schneier, Nassi, arXiv (2026-02)	The Promptware Kill Chain; Persistence stage	Adjacent primary-source framing situating scheduled-job persistence within a broader, independently documented multi-stage attack model.
MITRE ATLAS	`AML.T0051.002 LLM Prompt Injection: Triggered`; `AML.T0081 Modify AI Agent Configuration`; `AML.T0053 AI Agent Tool Invocation`	SSA-selected ATLAS techniques for delayed-firing injection delivery, the configuration write that creates the job, and the tool-invocation step that fires it.
OWASP GenAI Security Project	Top 10 for Agentic Applications 2026, `ASI06:2026 Memory & Context Poisoning`; `ASI05:2026 Unexpected Code Execution (RCE)`	ASI06 covers the state-persistence half of this pattern; ASI05 covers the command-execution half demonstrated by CVE-2026-31994.
MITRE, CWE	`CWE-78 Improper Neutralization of Special Elements Used in an OS Command`	The weakness classification for the script-generation defect underlying CVE-2026-31994.
Agent State Attack	Agent scheduled-task poisoning	SSA descriptive framing bundling the sleeper-channel research and the OpenClaw CVE under one Tool & Environment State entry.

Related terms

Agent state attack: the umbrella definition, including Tool & Environment State among the listed target states.
Agent plan poisoning: the adjacent, in-session persistence substrate, contrasted above by firing mechanism.
Agent checkpoint poisoning: another Tool & Environment State entry, triggered by session resume rather than a scheduler's own clock.
Persistent memory injection: the broader entry path for untrusted content causing any kind of durable write, of which a scheduling tool call is one specific case.
MCP tool poisoning: a related Tool & Environment State pattern concerning what a tool call's description or result claims, rather than what a scheduling tool is asked to commit.

FAQ

Is this the same thing as a classic cron-based malware persistence technique?

It shares the underlying mechanism, a recurring OS scheduler entry surviving past the event that created it, but the entry path differs. Classic persistence techniques require an attacker who already has code-execution access to write the scheduled entry directly. A sleeper channel instead reaches the schedule through an agent's own legitimate scheduling capability, triggered by untrusted content the agent processes as ordinary input, with no prior code execution required.

Does disabling an agent's scheduling feature fix this?

It removes the entry path at the cost of a capability many always-on agent deployments rely on for reminders, monitoring, and recurring work. Neither documented source treats removal as the fix: the OpenClaw advisory patched the script-generation defect, not the scheduling feature, and the Sleeper Channels paper proposes mediating the cron path with provenance gates rather than removing scheduling.

Sources

Verification and change history

Standards and versions referenced: OWASP Top 10 for Agentic Applications, Version 2026 (December 2025); MITRE ATLAS, data release v2026.06 (2026-06-30); CWE-78.

Last verified: 2026-10-06. The Sleeper Channels paper, its companion artifact, the CVE-2026-31994 record, the GitHub Security Advisory, the fix commit, and the Promptware Kill Chain paper were read from the sources' own pages on this date. The OWASP and MITRE identifiers were selected against this site's previously verified crosswalk entries.

Change history: 2026-10-06, first version.

Working-term label: Mixed provenance. "Sleeper channel" and "Provenance Gates" are a 2026 academic research term from Maloyan and Namiot. "Promptware" and its kill-chain stage names are a 2026 academic research term from Brodt, Feldman, Schneier, and Nassi. CVE-2026-31994 and GHSA-mqr9-vqhq-3jxw are Standard Terms owned by the CVE Program and GitHub Security Advisory Database respectively. ASI06:2026 and ASI05:2026 are OWASP Standard Terms. AML.T0051.002, AML.T0081, and AML.T0053 are MITRE ATLAS Standard Terms. CWE-78 is a MITRE Standard Term. "Agent scheduled-task poisoning" as the umbrella title for this entry is SSA descriptive wording, not a standard term.