After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
We present CarryoverBench: 12 personal-assistant scenarios and 101 attack tasks across three trigger channels: Instant, same-turn IPI; Autonomous, heartbeat-scheduled; and Latent, memory-resurfaced.
ProofPaper ↗
Key points
- Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input.
- A one-time indirect prompt injection committed to either channel can re-fire across sessions long after the attacker leaves, threats we term carryover attacks.
- Existing prompt-injection benchmarks evaluate attacks only in the session where malicious content is first observed, leaving the gate governing when and how often a planted payload later re-fires unmeasured.
- A rule-based verifier scores planting and triggering as independent stages.
Sources (1)
- [1]After the Attacker Leaves: Benchmarking Carryover Attacks on LLM AgentsarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 20, 03:55 PM
We present CarryoverBench: 12 personal-assistant scenarios and 101 attack tasks across three trigger channels: Instant, same-turn IPI; Autonomous, heartbeat-scheduled; and Latent, memory-resurfaced.
Modern LLM agents persist state across sessions via two channels: long-lived memory files silently prepended to the system prompt, and scheduled tasks waking the agent without user input.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 20, 2026How I built my ‘everything’ app
- Oct 20, 2026Voxtral 3
- Oct 20, 2026Exa 3.0 Search API Tops Perplexity, Brave and Parallel on 8 Benchmarks
- Oct 20, 2026Do Diffusion LLMs Scale? Testing Mercury 3 + Decide
- Oct 19, 2026Evaluating Agents on Highly Subjective Tasks
- Oct 19, 2026AdaExploreBench: Benchmarking LLM Agents for Proactive Exploration and Test-time Adaptation in Evolving Environments