Modern LLM agents keep state across sessions through two channels: long-lived memory files that are silently prepended to the system prompt, and scheduled tasks that wake the agent without user input. A new arXiv paper, "After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents," examines how these persistence mechanisms can be exploited.
The authors focus on the threat of a one-time indirect prompt injection. Because memory files and scheduled tasks remain active between sessions, a single injection could potentially influence an agent's behavior long after the attacker has stopped interacting with it. The paper benchmarks this class of "carryover" attacks.
The abstract does not detail specific results or defenses, but it frames the problem as a distinct security concern for agentic systems. The two persistence channels are presented as the key enablers, suggesting that any mitigation would need to address how state is stored and reactivated across sessions.