Agent State Attackdefensive reference

P-02 / Pillar

State Surfaces

Context, memory, goals, plans, tool results, artifacts, and shared agent state.

What state can change, and through which boundary?

State Surfaces

7 min

Agent Plan Poisoning: When Injected Content Rewrites an Agent's Own Task List

Agent plan poisoning is SSA descriptive wording for injected content that rewrites an agent's own live task or plan object, adding, reordering, or completing steps the user never approved, so a later step executes with the authority the user granted the original plan. Covers the documented Auto-GPT indirect-injection CVEs and the AgentDojo benchmark, with detection and containment for agents that maintain a persistent, tool-visible task list.

Target: Plans & ArtifactsPersistence: Session to Cross-Session

State Surfaces

9 min

Agentic Browser Session Hijacking: Indirect Prompt Injection Into Authenticated Browser State

Agentic browser session hijacking is SSA descriptive wording for indirect prompt injection that reaches an AI browser's authenticated session state, cookies, and autofill data rather than the model's instructions alone. Covers the documented Brave disclosures against Perplexity Comet and Guardio Labs' Scamlexity report, with detection and containment for agents that hold login state a user never explicitly reviewed per action.

Target: Tool & Environment StatePersistence: Session to Cross-Session

State Surfaces

8 min

Sandbox Configuration Escape: How AI Coding Agents Turn Their Own Execution Environment into Persistent, Trusted State

Sandbox configuration escape is SSA descriptive wording for a write a compromised agent session makes to host-trusted configuration, session hooks, or CI/build cache state from inside its own sandbox, so the write survives the session boundary and runs with full host or pipeline privilege on the next launch. Covers CVE-2026-25725 in Claude Code, the Cymulate CBSE findings across Claude Code, Gemini CLI, and Codex CLI, and the Clinejection supply-chain compromise of Cline, with detection and containment that does not require abandoning sandboxed execution.

Target: Tool & Environment StatePersistence: Cross-Session to Shared-System

State Surfaces

9 min

RAG Poisoning: Security Risks When Retrieved Content Becomes an Agent's Context

RAG poisoning is SSA descriptive wording for adversarial content placed into a knowledge base, document store, or vector index so that retrieval loads it into an agent's live context as if it were trusted ground truth. Covers the documented PoisonedRAG attack methodology, the Slack AI and Microsoft 365 Copilot disclosures, and the Morris II worm, with detection and containment that does not require abandoning retrieval.

Target: ContextPersistence: Session to Shared-System

State Surfaces

9 min

MCP Tool Poisoning: Security Risks of Tool Descriptions, Tool Results, and Rug Pulls

MCP tool poisoning is SSA descriptive wording for adversarial content placed in tool descriptions, tool-call results, or post-approval tool definitions, so an agent treats hidden instructions as trusted metadata rather than untrusted input. Covers the documented Invariant Labs proofs of concept, the GitHub MCP issue exploit, and the postmark-mcp npm rug pull, with detection and containment that does not require disconnecting every server.

Target: Tool & Environment StatePersistence: Session to Cross-Session

State Surfaces

10 min

Shared State Poisoning in Multi-Agent Systems: Blackboards, Handoffs, and Session Smuggling

Shared state poisoning is SSA descriptive wording for adversarial writes to state that more than one agent or session reads as trusted: blackboard records, A2A handoff payloads, and shared memory. Covers the documented agent session smuggling technique, detection signals, and containment before one poisoned object compromises a whole agent network.

Target: Shared & Multi-Agent StatePersistence: Session to Shared-System

State Surfaces

10 min

Slopsquatting: Security Risks of Hallucinated Package Names in Agent-Generated Plans and Artifacts

Slopsquatting is SSA descriptive wording for the exploitation of a coding agent's own generated artifact, a dependency manifest, import statement, or install command referencing a package that does not exist, once an adversary pre-registers that predictable name on a public registry. Covers the documented package-hallucination research, the huggingface-cli proof of concept, and detection and containment that does not require banning agent-written dependency lists.

Target: Plans & ArtifactsPersistence: Cross-Session to Shared-System

State Surfaces

9 min

Instruction File Poisoning: Security Risks of CLAUDE.md, AGENTS.md, and Agent Configuration Files

Instruction file poisoning is SSA descriptive wording for adversarial content placed into a project configuration file an agent auto-loads as trusted, standing guidance: CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, and similar. Covers the documented Rules File Backdoor and TrapDoor campaigns, the Claude Code hooks CVEs, and containment that keeps repository-level customization useful.

Target: Goals & InstructionsPersistence: Cross-Session to Shared-System

State Surfaces

8 min

Persistent Memory Injection: Security Risks of AI Agent Memory-Write Tools

Persistent memory injection is SSA descriptive wording for adversarial content written into an agent's own long-term memory store through its memory-write tool, so it survives the session that created it and is read as trusted fact in every later one. Covers documented cases across ChatGPT, Gemini, and Claude, plus detection and containment that does not require disabling memory.

Target: Durable MemoryPersistence: Cross-Session

State Surfaces

11 min

Compromised Summaries and Context Compaction: Security Risks for AI Agents

What the security risks of context compaction are for AI agents: how compaction can preserve adversarial state while dropping valid constraints, what evidence to log, and how to prevent, contain, and recover from compromised summaries without publishing attack recipes.

Target: Context and Durable MemoryPersistence: Session to Cross-Session