Context Persistence Attack

The defining feature of a context persistence attack is the delayed activation. The malicious payload remains dormant in the agent's long-term memory or conversation history, waiting for a specific trigger.

• Session-based triggers: Activate on the Nth user session after planting
• Temporal triggers: Execute on a specific date or after a time interval
• Conditional triggers: Fire when the agent encounters a specific user, topic, or tool
• Chained triggers: Require multiple sequential conditions before activation

This temporal decoupling between insertion and execution bypasses real-time prompt firewalls that only inspect immediate inputs.

Attackers exploit the agent's stateful architecture by writing to persistent memory stores that survive individual sessions.

• Chat history poisoning: Injecting instructions into conversation logs that are re-ingested as context in future sessions
• Vector store seeding: Planting malicious documents in retrieval-augmented generation (RAG) knowledge bases that appear benign until queried with a specific trigger phrase
• Episodic memory injection: Corrupting the agent's stored experiences or reflection logs with adversarial examples
• User profile manipulation: Modifying stored user preferences or persona data that the agent references across sessions

The attack surface expands with every persistent memory mechanism the agent employs.

Persistent payloads evade detection by masquerading as legitimate context data rather than executable commands.

• Instruction embedding: Wrapping malicious directives in formats that mimic system-generated metadata or prior legitimate outputs
• Semantic blending: Phrasing payloads as benign user preferences, notes, or historical facts the agent should remember
• Encoding obfuscation: Using base64, Unicode homoglyphs, or whitespace steganography to hide commands in plain sight
• Fragmentation: Splitting the payload across multiple memory entries that only form a complete instruction when the agent retrieves and assembles them

This camouflage exploits the agent's inability to distinguish between authentic historical context and planted adversarial memory.

The attack leverages the agent's continuity mechanisms—the very features designed to create seamless user experiences across sessions.

• Conversation summarization: Malicious content in a long conversation gets compressed into a summary that preserves the adversarial intent while losing the suspicious original phrasing
• Memory consolidation: Episodic memory systems that periodically distill interactions into long-term storage may inadvertently preserve and strengthen adversarial patterns
• Context window rollover: When conversation length exceeds the context window, summarization or truncation may retain the planted payload while discarding the surrounding benign context that could have provided exculpatory evidence
• Retrieval augmentation: RAG systems that fetch relevant history may retrieve and prioritize the poisoned entries due to keyword matching with the trigger query

The delayed nature of context persistence attacks enables compounding damage that far exceeds immediate injection attacks.

• Privilege escalation over time: The agent may gain access to new tools or data sources between planting and activation, expanding the attacker's reach
• Multi-user propagation: In shared agent environments, a poisoned memory entry planted by one user can activate during another user's session
• Data exfiltration windows: The dormant payload can slowly accumulate and encode sensitive data over multiple sessions before triggering a bulk exfiltration
• Supply chain cascades: An agent compromised via persistent context may poison downstream systems, other agents in a multi-agent mesh, or generate poisoned outputs that contaminate training data for future model iterations

Context persistence attacks are specifically designed to defeat real-time security controls through temporal and structural obfuscation.

• Perplexity normalization: Payloads are crafted to maintain natural language perplexity scores, evading statistical anomaly detectors
• Semantic filter bypass: The dormant state contains no overtly malicious intent—only the trigger combination reveals the attack, making semantic safety classifiers ineffective at insertion time
• Gradual trust establishment: The attacker may plant benign-seeming memory entries over multiple sessions to establish a pattern of legitimate behavior before inserting the actual payload
• Self-repair mechanisms: Advanced payloads include instructions for the agent to reconstruct the malicious logic if partial cleanup or memory pruning occurs

These evasion strategies necessitate continuous memory auditing rather than point-in-time input filtering.