Agent State Attackdefensive reference

P-02 / Pillar

State Surfaces

Context, memory, goals, plans, tool results, artifacts, and shared agent state.

What state can change, and through which boundary?

State Surfaces

8 min

Embedding Inversion Attacks: How Attackers Reconstruct Private Text From an Agent's Vector-Store Memory

Embedding inversion is SSA descriptive wording for reconstructing the private text behind a stored vector embedding, the representation an agent's retrieval corpus or long-term memory is actually built from. Covers the documented Song and Raghunathan input-inversion attack, the Vec2Text reconstruction method, and the 2025 ALGEN and ZSInvert few-shot and zero-shot attacks, with detection and containment that does not require abandoning embedding-based memory.

Target: Durable MemoryPersistence: Cross-Session to Shared-System

State Surfaces

8 min

KV-Cache Prompt Leakage: Timing Side-Channel Attacks That Steal System Prompts From Shared LLM Caches

KV-cache prompt leakage is SSA descriptive wording for an attacker measuring response-time differences in a shared LLM serving cache to infer the content of a confidential system prompt or another tenant's private prompt, with no injection, no credential theft, and no error in any access-control check. Covers the documented PROMPTPEEK, Early Bird, and prompt-caching-audit research, and detection and containment that does not require disabling prompt caching.

Target: ContextPersistence: Session to Shared-System

State Surfaces

7 min

RAG Permission Bypass: When Retrieval Ignores Document-Level Access Control

RAG permission bypass is SSA descriptive wording for a retrieval-augmented pipeline serving content a querying user or session was never authorized to see, because the index flattened the source system's access control or the retrieval step never re-checked it. Covers the ConfusedPilot research's confused-deputy framing against Microsoft 365 Copilot and CVE-2026-21836, a 2026 broken-access-control flaw in HCL DominoIQ's RAG feature, with detection and containment that does not require disabling retrieval.

Target: Tool & Environment StatePersistence: Session to Shared-System

State Surfaces

9 min

AI Agent Clipboard Hijacking: ClickFix-Style Clipboard Poisoning Against Agentic Terminals and Browsers

Agent clipboard hijacking is SSA descriptive wording for the risk that the shared OS or browser clipboard, a channel built for a human to copy and paste, becomes attacker-controlled once an AI agent sits on either end of it. Covers the June 2026 GitHub advisory GHSA-wgqj-4c26-7c4g (CVE-2026-48725, CVSS 8.1 High), where Warp's agentic terminal let untrusted output read or write the local clipboard through OSC 52 with no confirmation step; MITRE ATLAS case study AML.CS0055, where a researcher got Anthropic's Claude Computer-Use agent to copy a malicious command to its own clipboard, paste it into a terminal, and run it; and the October 2025 report that OpenAI's Atlas browser agent could itself be tricked into overwriting a user's clipboard with a phishing link.

Target: Tool & Environment StatePersistence: Single Turn to Session

State Surfaces

8 min

Target-State Script Injection: Declarative Config and Infrastructure Tools as a Code-Execution Path for AI Agents

Target-state script injection is SSA descriptive wording for a declarative config or infrastructure-as-code tool executing attacker-controlled commands as the documented mechanism for reaching a declared target state, not as a bug in any one tool. Covers chezmoi's documented run_ and modify_ script model, the September 2026 Coder registry compromise that shipped credential-stealing Terraform modules through a data.external block (GHSA-vx42-ghc9-gw65), and the Miasma worm as evidence that AI coding agents already execute repo-shipped setup artifacts without per-file review.

Target: Tool & Environment StatePersistence: Cross-Session to Shared-System

State Surfaces

9 min

Agent Command-Approval Bypass: Shell Rewriting and Git Hooks Against AI Coding-Agent Guardrails

Agent command-approval bypass is SSA descriptive wording for a gap between what a coding agent's own guardrail inspects before approving a shell or git action and what the underlying interpreter actually runs. Covers the documented GuardFall research showing bash's own quote-removal and expansion defeat raw-string guards in 10 of 11 open-source coding agents, and two Cursor CVEs, CVE-2026-22708 and CVE-2026-26268, where an allowlist and a sandbox's write protection were each bypassed through a different mechanism, with detection and containment that does not require disabling agent-run commands.

Target: Tool & Environment StatePersistence: Single Turn to Cross-Session

State Surfaces

8 min

Agent Scheduled-Task Poisoning: How Sleeper Channels Turn Cron Jobs Into Standing Backdoors

Agent scheduled-task poisoning is SSA descriptive wording for a sleeper channel: untrusted content reaching an always-on agent through one surface, a chat message, an email, a retrieved page, writes a cron entry or scheduled job that fires later through a different surface with no attacker present at execution time. Covers the May 2026 academic paper that named and formalized sleeper channels against the OpenClaw and Hermes Agent frameworks, and CVE-2026-31994 (GHSA-mqr9-vqhq-3jxw), a real command-injection flaw in OpenClaw's own Windows scheduled-task generation code, with detection and containment that does not require disabling scheduling.

Target: Tool & Environment StatePersistence: Cross-Session

State Surfaces

5 min

URL Parameter Prompt Injection: How Deep Links Poison AI Agent Memory and OAuth-Connected State

URL parameter prompt injection is SSA descriptive wording for an attack that reaches an AI agent's state through a crafted link rather than typed input, a retrieved document, or a tool result: the attacker's instructions ride in a query-string parameter the agent treats as a prompt to run, in the worst documented case with no confirmation step at all. Covers Varonis's CoSnitch finding against Microsoft Copilot (CVE-2026-24301), where memory poisoning survived a password reset, and Oasis Security's Claudy Day finding against Claude.ai, with detection and containment that does not require removing deep-link support.

Target: Durable MemoryPersistence: Cross-Session

State Surfaces

7 min

Semantic Cache Poisoning: How a Shared LLM Response Cache Becomes an Agent Attack Surface

Semantic cache poisoning is an attack on the embedding-matched response cache many LLM and agent deployments run in front of inference: an attacker writes one crafted (query, response) pair, and any later user whose wording lands within the similarity threshold gets the attacker's answer with no model call at all. Covers the NDSS 2026 research demonstrating 81-89% attack success against GPTCache and its AWS Bedrock, Azure, and Alibaba Higress integrations, why existing prompting defenses failed against it, and detection and containment that does not require turning caching off.

Target: ContextPersistence: Session to Shared-System

State Surfaces

9 min

MCP Confused Deputy and Token Passthrough: Agent OAuth Authorization State Attacks

MCP confused deputy and token passthrough target the OAuth state an MCP server holds on an agent's behalf: a static client ID and consent cookie an attacker can ride to steal an authorization code, or an access token accepted and forwarded downstream without checking who it was actually issued for. Covers the protocol's own MUST-NOT requirements, the CVE-2026-48039 Meta Ads MCP token leak, and Asana's 2025 cross-tenant MCP incident, with detection and containment that does not require disabling OAuth-backed tools.

Target: Tool & Environment StatePersistence: Session to Shared-System

State Surfaces

9 min

Agent Card Poisoning: A2A Protocol Discovery and Identity Spoofing Defenses

Agent card poisoning targets the JSON manifest an A2A agent publishes at /.well-known/agent-card.json to advertise its identity, skills, and authentication requirements, before any session or message exchange begins. Covers Keysight's documented metadata-injection proof of concept, CSA's MAESTRO impersonation threats, and an open CWE-863 trust-root flaw in the A2A specification's own card-signing design, with detection and containment that does not require disabling agent discovery.

Target: Shared & Multi-Agent StatePersistence: Cross-Session to Shared-System

State Surfaces

7 min

Agent Checkpoint Poisoning: Insecure Deserialization and Rollback Attacks on Agent State Stores

Agent checkpoint poisoning is SSA descriptive wording for a write to an agent's serialized execution-state store, its checkpoint or session-resume record, that executes attacker-controlled code the moment a later session deserializes it, or that restores a state whose security invariants never actually held together. Covers the documented LangGraph checkpointer deserialization CVEs and the Microsoft Agent Framework cross-session rollback RCE, with detection and containment that does not require disabling resume.

Target: Tool & Environment StatePersistence: Session to Shared-System

State Surfaces

7 min

Many-Shot Context Poisoning: Security Risks of Long-Context Demonstration Flooding

Many-shot context poisoning is SSA descriptive wording for filling an agent's active context with a large volume of repeated, pattern-forming content so the model continues that pattern on a later, unrelated input, independent of whether any single item in the flood reads as a false fact or a hidden instruction. Covers Anthropic's documented many-shot jailbreaking research and its extension to any long tool result or retrieved document an agent ingests, with detection and containment that does not require shrinking context windows.

Target: ContextPersistence: Single Turn to Session

State Surfaces

7 min

Agent Plan Poisoning: When Injected Content Rewrites an Agent's Own Task List

Agent plan poisoning is SSA descriptive wording for injected content that rewrites an agent's own live task or plan object, adding, reordering, or completing steps the user never approved, so a later step executes with the authority the user granted the original plan. Covers the documented Auto-GPT indirect-injection CVEs and the AgentDojo benchmark, with detection and containment for agents that maintain a persistent, tool-visible task list.

Target: Plans & ArtifactsPersistence: Session to Cross-Session

State Surfaces

9 min

Agentic Browser Session Hijacking: Indirect Prompt Injection Into Authenticated Browser State

Agentic browser session hijacking is SSA descriptive wording for indirect prompt injection that reaches an AI browser's authenticated session state, cookies, and autofill data rather than the model's instructions alone. Covers the documented Brave disclosures against Perplexity Comet and Guardio Labs' Scamlexity report, with detection and containment for agents that hold login state a user never explicitly reviewed per action.

Target: Tool & Environment StatePersistence: Session to Cross-Session

State Surfaces

8 min

Sandbox Configuration Escape: How AI Coding Agents Turn Their Own Execution Environment into Persistent, Trusted State

Sandbox configuration escape is SSA descriptive wording for a write a compromised agent session makes to host-trusted configuration, session hooks, or CI/build cache state from inside its own sandbox, so the write survives the session boundary and runs with full host or pipeline privilege on the next launch. Covers CVE-2026-25725 in Claude Code, the Cymulate CBSE findings across Claude Code, Gemini CLI, and Codex CLI, and the Clinejection supply-chain compromise of Cline, with detection and containment that does not require abandoning sandboxed execution.

Target: Tool & Environment StatePersistence: Cross-Session to Shared-System

State Surfaces

9 min

RAG Poisoning: Security Risks When Retrieved Content Becomes an Agent's Context

RAG poisoning is SSA descriptive wording for adversarial content placed into a knowledge base, document store, or vector index so that retrieval loads it into an agent's live context as if it were trusted ground truth. Covers the documented PoisonedRAG attack methodology, the Slack AI and Microsoft 365 Copilot disclosures, and the Morris II worm, with detection and containment that does not require abandoning retrieval.

Target: ContextPersistence: Session to Shared-System

State Surfaces

9 min

MCP Tool Poisoning: Security Risks of Tool Descriptions, Tool Results, and Rug Pulls

MCP tool poisoning is SSA descriptive wording for adversarial content placed in tool descriptions, tool-call results, or post-approval tool definitions, so an agent treats hidden instructions as trusted metadata rather than untrusted input. Covers the documented Invariant Labs proofs of concept, the GitHub MCP issue exploit, and the postmark-mcp npm rug pull, with detection and containment that does not require disconnecting every server.

Target: Tool & Environment StatePersistence: Session to Cross-Session

State Surfaces

10 min

Shared State Poisoning in Multi-Agent Systems: Blackboards, Handoffs, and Session Smuggling

Shared state poisoning is SSA descriptive wording for adversarial writes to state that more than one agent or session reads as trusted: blackboard records, A2A handoff payloads, and shared memory. Covers the documented agent session smuggling technique, detection signals, and containment before one poisoned object compromises a whole agent network.

Target: Shared & Multi-Agent StatePersistence: Session to Shared-System

State Surfaces

10 min

Slopsquatting: Security Risks of Hallucinated Package Names in Agent-Generated Plans and Artifacts

Slopsquatting is SSA descriptive wording for the exploitation of a coding agent's own generated artifact, a dependency manifest, import statement, or install command referencing a package that does not exist, once an adversary pre-registers that predictable name on a public registry. Covers the documented package-hallucination research, the huggingface-cli proof of concept, and detection and containment that does not require banning agent-written dependency lists.

Target: Plans & ArtifactsPersistence: Cross-Session to Shared-System

State Surfaces

9 min

Instruction File Poisoning: Security Risks of CLAUDE.md, AGENTS.md, and Agent Configuration Files

Instruction file poisoning is SSA descriptive wording for adversarial content placed into a project configuration file an agent auto-loads as trusted, standing guidance: CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, and similar. Covers the documented Rules File Backdoor and TrapDoor campaigns, the Claude Code hooks CVEs, and containment that keeps repository-level customization useful.

Target: Goals & InstructionsPersistence: Cross-Session to Shared-System

State Surfaces

8 min

Persistent Memory Injection: Security Risks of AI Agent Memory-Write Tools

Persistent memory injection is SSA descriptive wording for adversarial content written into an agent's own long-term memory store through its memory-write tool, so it survives the session that created it and is read as trusted fact in every later one. Covers documented cases across ChatGPT, Gemini, and Claude, plus detection and containment that does not require disabling memory.

Target: Durable MemoryPersistence: Cross-Session

State Surfaces

11 min

Compromised Summaries and Context Compaction: Security Risks for AI Agents

What the security risks of context compaction are for AI agents: how compaction can preserve adversarial state while dropping valid constraints, what evidence to log, and how to prevent, contain, and recover from compromised summaries without publishing attack recipes.

Target: Context and Durable MemoryPersistence: Session to Cross-Session