Agent State Attack: Definition, Scope, and Boundaries

An agent state attack is a deliberate attempt to alter, contaminate, suppress, or exploit the runtime state that governs an AI agent's later decisions. The target may include context, memory, goals, plans, tool results, or shared state, without requiring any change to the model's weights. This is the Agent State Attack site's working definition, not a term defined by a standard.

What it is

The defining object is runtime state: information an agent or its surrounding application can read during later decisions. The defining cause is adversarial intent. The defining consequence is a change in what the agent subsequently believes, prioritizes, permits, or does.

This definition provides a state-centered reference layer across threat categories already described by agent-security surveys, OWASP risk lists, and MITRE ATLAS. It does not replace those sources or claim that they use the term "agent state attack." Two broad agent-security surveys show why a connecting layer is useful: the same system can expose model, application, tool, memory, and environment surfaces, while each source organizes those surfaces for a different purpose (A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework; Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges).

Because this article is the umbrella entry, its classification fields read `Multiple`. Individual state surfaces, entry paths, and effects are classified on the focused articles rather than compressed into one representative value here.

In scope

Deliberate changes to active context, durable memory, goals, plans, tool observations, shared artifacts, or inter-agent state.
Attempts to make malicious state survive beyond the input that introduced it.
Attempts to suppress a valid policy or constraint in the operative state, even when the source text remains stored elsewhere.
Exploitation of already-corrupted state to influence a later decision or authorized action.
Defensive analysis of prevention, detection, containment, and recovery at state and authority boundaries.

What it is not

Changes to model weights, training procedures, or model binaries when no runtime agent state is involved.
Accidental degradation caused by long sessions, stale plans, lossy summaries, or ordinary operating error.
Invalid or misleading input that is rejected before it can influence trusted state or a consequential decision.
A model producing an isolated wrong answer with no evidence of deliberate state manipulation.
Reproducible payloads, bypass instructions, product-specific exploit procedures, or advice for improving attack success.

An incident can cross these boundaries. A poisoned training artifact may later produce compromised runtime state, or an injected observation may cause durable memory to be rewritten. The classification should follow each state transition rather than force the whole incident into one label.

Target state and trust boundaries

An agent state attack matters when untrusted influence crosses one or more of four boundaries.

The intake boundary separates user input, retrieved content, tool output, inter-agent messages, and external artifacts from state the application treats as reliable.
The write boundary governs whether observed material can become active context, a durable memory, a goal, a plan, or a shared artifact.
The decision boundary governs which state is allowed to determine a later inference, authorization request, or tool choice.
The action boundary separates a model-influenced proposal from an external effect such as changing data, contacting another system, or committing an artifact.

The abstract path is `untrusted influence -> state write -> later decision -> guarded action`. Not every event reaches every stage. A preventive control can stop the write, a detector can flag the changed state, containment can block propagation or action, and recovery can replace compromised state with a verified checkpoint.

Persistence

The target may be ephemeral or persistent. Context can affect one turn. A summary can persist for a session. Durable memory can cross sessions. A shared artifact can influence multiple agents or users. Persistence changes the blast radius, but it is not required by this definition.

Preconditions and impact

At least three conditions are normally relevant to the threat model.

First, an adversary needs an influence path into information the system will process. Second, the application must permit that information to affect operative state without sufficient separation, provenance, or validation. Third, the compromised state must remain influential when a later decision is made.

The resulting effect can be false-belief insertion, instruction override, goal redirection, policy suppression, authority misuse, or propagation. These are state and control outcomes, not claims that an external action necessarily succeeded. A compromised plan with no authority to act still represents a state-integrity failure, while a least-privilege boundary may prevent it from becoming a material incident.

Detection: observable signs

No single signal proves an agent state attack. Useful evidence comes from changes that can be connected across boundaries.

A goal, constraint, or trusted fact changes without an authorized write or an attributable source.
A summary preserves untrusted instructions while omitting a previously enforced constraint.
The same unsupported belief reappears after the initiating content has left the active context.
A durable-memory record lacks provenance, has an unexpected writer, or was promoted from low-trust content without review.
An agent cites a tool result or another agent's message as authority rather than as an observation.
A proposed action conflicts with a deterministic policy even though the model describes it as consistent with prior instructions.
Multiple agents begin repeating the same unsupported state after reading a shared artifact.

These signs should be correlated with input records, state diffs, write decisions, provenance, policy checks, and action requests. Output text alone does not establish where the integrity failure occurred, because the same wording can follow from a benign summary, an accidental omission, or a deliberate write.

Defenses, containment, and recovery

The table below is SSA editorial guidance for defenders. It is neither a standard requirement nor a measured effectiveness ranking. Each row names the transition a control interrupts, when it applies, and how to check that it works in a specific system.

| Control | Transition it interrupts | Applicability | Residual risk and verification | | --- | --- | --- | --- | | Trust labeling and provenance | Observation becoming trusted state | Systems that combine user, retrieval, tool, or agent content | Labels can be dropped during transformation. Test that provenance survives storage, summarization, and sharing. | | Restricted state writes | Low-trust content becoming context, memory, goals, or plans | Agents with application-managed state | An allowed writer may still make a bad promotion. Log the source, reason, writer, and resulting diff. | | Deterministic policy and authorization | Compromised state becoming a consequential action | Tool-using agents | A policy cannot protect an action it does not cover. Test denied and approval-required paths independently of model wording. | | State-integrity monitoring | Silent changes remaining undetected | Systems with versioned state or checkpoints | Semantic changes can evade exact diffs. Combine structural diffs with explicit invariant checks. | | Quarantine and propagation controls | One compromised object influencing more agents or sessions | Shared memory and multi-agent systems | Existing copies may remain active. Track readers, descendants, and cached versions. | | Verified reset and revalidation | Compromised state surviving incident response | Systems that can reconstruct state from trusted sources | A checkpoint may already be contaminated. Verify its provenance and replay post-checkpoint writes before resuming. |

Containment should freeze or isolate suspect state before deleting evidence. Recovery should restore the smallest verified state set, revalidate dependent memories and artifacts, and keep high-impact actions disabled until invariants pass. A reset that reloads the same unverified summary is not recovery.

Disambiguation: OS-layer "self-state attacks"

This site's term is not the "self-state attack" defined by the paper *Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?*, posted as arXiv 2607.17986 on July 20, 2026. Its Definition 1 reads: "A self-state attack is an attack in which a compromised agent issues file-system operations against its own persistent state (memory, instruction, or configuration) using the same OS operations and authorization it uses for legitimate self-state updates" (arXiv 2607.17986).

Three points matter for readers who arrive from that paper.

First, the paper assumes an adversary. Its threat model states that the attacker "can place arbitrary content into channels the agent reads (documents, web pages, messages, tool outputs) and use that content to compromise the agent's decision process via indirect prompt injection or related techniques." Indirect prompt injection is therefore the assumed route to compromise, not an excluded category. What the paper sets aside is the study of that route: it notes that "how compromise is achieved (the prompt-injection layer) has been studied separately" and focuses instead on what an already-compromised agent can do to its own persistent files.

Second, the paper does not exclude memory poisoning. It anchors its own state layers to existing catalogs, mapping memory-state cells to `AML.T0080.000` (AI Agent Context Poisoning: Memory), instruction-state cells to `AML.T0080` (AI Agent Context Poisoning), and configuration-state cells to `AML.T0081` (Modify AI Agent Configuration).

Third, what the paper places out of scope is a different set: direct host access, attacks on model weights or training such as jailbreak, model extraction, and supply-chain compromise, and an attacker who simultaneously controls the agent and the defense components.

The useful distinction is therefore analytical layer and indistinguishability, not the presence or absence of an adversary.

| Question | Agent state attack, this site's working term | Self-state attack, arXiv 2607.17986 | | --- | --- | --- | | Primary layer of analysis | Application-managed runtime state: context, memory, goals, plans, tool results, and shared state | Persistent self-state files on the host: memory state, instruction state, and configuration state | | Assumed route to compromise | Any untrusted influence path, including but not limited to prompt injection | Compromise already achieved, typically through indirect prompt injection in adversary-readable channels | | Central difficulty | Untrusted influence becoming operative state that governs a later decision | Attack operations are a subset of legitimate operations on the same files with the same authorization, so authorization alone cannot separate them | | Stated out of scope | Weight and training attacks with no runtime state involvement, accidental decay, rejected input | Direct host access, weight and training attacks including jailbreak and model extraction, and an attacker controlling both agent and defenses | | Authority | SSA editorial working definition | Research Term defined by the paper's authors |

The two terms overlap rather than exclude each other. A self-state attack that rewrites durable memory or instruction files, and thereby changes a later decision, also satisfies this site's working definition. The reverse does not hold: an agent state attack confined to a single turn of active context involves no persistent file write and would fall outside the paper's definition. Use each term with its own source attribution rather than as a synonym for the other.

Boundaries with similar concepts

Model-weight attacks

A model-weight attack changes or exploits the learned parameters or model artifact. An agent state attack changes information used at runtime without requiring a weight change. If a model attack causes runtime memory or goals to be contaminated, describe the weight compromise and the state compromise as separate stages.

Prompt injection

The OWASP Top 10 for LLM Applications, Version 2025, includes `LLM01:2025 Prompt Injection`, while the OWASP Top 10 for Agentic Applications, Version 2026, includes `ASI01 Agent Goal Hijack` and `ASI06 Memory & Context Poisoning` among its named risks (OWASP Top 10 for LLM Applications 2025; OWASP Top 10 for Agentic Applications 2026). Prompt injection describes an input and instruction-control problem. Agent state attack is a proposed umbrella for the later state transition. Some prompt injection is ephemeral, some becomes persistent, and not every state attack begins with prompt injection.

Ordinary invalid input

Bad input is not automatically an attack on agent state. The working term applies when deliberate influence alters, suppresses, contaminates, or exploits state that governs later decisions. Rejected input and an isolated parse error stay outside unless another state transition occurs.

Accidental behavioral state decay

Behavioral state decay is the sister reference's term for non-adversarial runtime degradation as sessions age, context accumulates, summaries lose detail, or environments change. The observed behavior may resemble a state attack, but causation separates the categories: deliberate manipulation belongs here; accidental degradation belongs to BSD. When an attack initiates a longer behavioral decline, SSA describes the compromise and containment, while BSD describes the trajectory and measurement.

Relationship to standards and research

This definition is a navigation layer, not a new risk list.

The OWASP Top 10 for LLM Applications, Version 2025, published November 18, 2024, provides application risk categories including `LLM01:2025 Prompt Injection`, `LLM04 Data and Model Poisoning`, `LLM06:2025 Excessive Agency`, `LLM07:2025 System Prompt Leakage`, and `LLM08:2025 Vector and Embedding Weaknesses` (OWASP Top 10 for LLM Applications 2025).
The OWASP Top 10 for Agentic Applications, Version 2026, published December 2025, names ten agent-oriented risks: `ASI01 Agent Goal Hijack`, `ASI02 Tool Misuse and Exploitation`, `ASI03 Identity and Privilege Abuse`, `ASI04 Agentic Supply Chain Vulnerabilities`, `ASI05 Unexpected Code Execution (RCE)`, `ASI06 Memory & Context Poisoning`, `ASI07 Insecure Inter-Agent Communication`, `ASI08 Cascading Failures`, `ASI09 Human-Agent Trust Exploitation`, and `ASI10 Rogue Agents` (OWASP Top 10 for Agentic Applications 2026).
MITRE ATLAS organizes attacker behavior rather than publishing a ranked risk list. Release v2026.06, published June 30, 2026, contains `AML.T0080 AI Agent Context Poisoning` with the sub-techniques `AML.T0080.000 Memory` and `AML.T0080.001 Thread`, alongside `AML.T0051 LLM Prompt Injection` and `AML.T0081 Modify AI Agent Configuration` (MITRE ATLAS; ATLAS release v2026.06).
Research papers may define narrower mechanisms or named attacks. Their definitions should retain author attribution and should not be silently promoted into standards.

The companion OWASP and MITRE ATLAS crosswalk maps the state-relevant overlaps while preserving these differences in purpose.

Related terms

Compromised summaries and context compaction: a state surface where untrusted content can survive and valid constraints can disappear.
OWASP and MITRE ATLAS crosswalk: a mapping of risk categories and attacker-behavior entries relevant to agent state.
Behavioral state decay: the non-adversarial sister concept.
Prompt injection: an input and instruction-control risk that can initiate a state attack.
Memory poisoning: contamination of state intended to influence later decisions, often beyond the initiating turn.

FAQ

Is "agent state attack" an OWASP, NIST, or MITRE term?

No. It is an SSA Working Term. OWASP and MITRE provide related risk and behavior categories, but this site's umbrella definition must not be attributed to them. As of the verification date below, the term does not appear in the NIST Computer Security Resource Center glossary, in the OWASP risk names above, or in the ATLAS technique names. If a recognized authority later defines the same term, this page will record the difference and update history.

Is an agent state attack the same as a self-state attack?

No, but they overlap. The self-state attack of arXiv 2607.17986 is a research term for OS-level writes by a compromised agent to its own memory, instruction, and configuration files. An incident can satisfy both definitions. Attribute each term to its own source instead of treating them as synonyms.

Must an attack persist across sessions?

No. A deliberate state change that governs a later decision can last one turn, one session, multiple sessions, or a shared system. Persistence affects severity, detection, and recovery, not membership in the working definition.

Does every prompt injection count as an agent state attack?

No. The concepts overlap, but their boundaries differ. Prompt injection identifies an instruction-control route. This definition additionally asks whether runtime state governing a later decision was altered, suppressed, contaminated, or exploited.

Is a hallucination an agent state attack?

Not by itself. An unsupported output can arise without adversarial influence. Treat it as a possible signal only when provenance, state changes, or related evidence supports deliberate manipulation.

Why exclude model weights?

The exclusion keeps the reference focused on runtime integrity and makes the control boundary testable. Weight compromise remains important, but it needs different evidence and recovery. If it produces compromised runtime state, both stages should be recorded.

Sources

Verification and change history

Standards and versions referenced on this page:

OWASP Top 10 for LLM Applications, Version 2025, published 2024-11-18.
OWASP Top 10 for Agentic Applications, Version 2026, published December 2025.
MITRE ATLAS, data release v2026.06, published 2026-06-30.

Last verified: 2026-07-29. On that date the OWASP version labels and item names were read from the official project documents, and the ATLAS technique identifiers and names were read from the official v2026.06 data release.

Change history: 2026-07-29, initial defensive draft. 2026-07-29, revised: the self-state attack disambiguation was rewritten against the primary text of arXiv 2607.17986, official OWASP and MITRE identifiers replaced secondary summaries, and the classification fields were widened for an umbrella entry. Not scheduled for publication.

Working-term label: **SSA Working Term.** "Agent state attack" is an editorial working definition of Agent State Attack, not a standard or research term.