After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
How hackers can hijack AI assistants long after they leave
Researchers discovered that a single malicious prompt injection can trick AI assistants into repeating harmful instructions across multiple sessions—sometimes dozens of times—long after an attacker has gone. Testing five major AI models, they found that once malicious code gets planted in an agent's persistent memory or scheduled tasks, it re-fires reliably across follow-up sessions with almost no degradation, and defenses at the prompt level alone don't stop it.
AI assistants increasingly manage real tasks—sending emails, accessing files, scheduling actions—across multiple conversations without human oversight between sessions. A carryover attack means a hacker could plant one malicious instruction that executes automatically hours or days later without the user knowing, potentially stealing data, modifying files, or taking unwanted actions. Fixing this requires changes at the system level, not just in how prompts are written.