SPA: Securing Persistent LLM Agents Across Queries with Plan-First Information-Flow Control
Protecting AI agents from poisoned data across multiple conversations
AI assistants that remember past work and pull from untrusted websites are vulnerable to attackers who slip malicious data into their memory or sources — then exploit it in future tasks. Researchers built SPA, a system that makes the agent plan out its full approach before executing it, then tracks data flows like a security auditor, stopping poisoned information from reaching sensitive actions. In tests, this reduced successful attacks from common rates down to nearly zero.
As AI agents handle more real work — scheduling, filing forms, accessing accounts — they become targets for attackers who can slip false information into websites or documents the agent reads. A poisoned fact lodged in the agent's memory could reactivate in an unguarded moment weeks later and cause damage. SPA's approach means companies deploying persistent AI agents can do so without accepting uncontrolled security risk from data sources outside their control.