What happens when an AI agent’s memory is poisoned for the next task?
RedClaw-Bench tests attacks that lodge instructions in agent memory, profiles and skill files, then wait for later tasks. The 330-case preprint found high attack rates in several model–harness combinations, but every case was synthetic and isolated.
The short version
- What happened
- AutoRedClaw generated executable cases that target five persistent surfaces—agent instructions, memory, user profile, persona and installed skills—then validated the resulting state changes inside isolated containers.
- Who it affects
- Workers using long-lived assistants need a visible history of memory, profile and skill changes. Administrators should make sensitive persistent files difficult for ordinary web content or email to modify without approval.
- What remains unproven
- The paper is an unreviewed preprint and has not been independently replicated.
The benchmark separates planting from later execution
The pipeline first generates a legitimate user task, an attacker goal, files or simulated web applications and state-based success checks. It then tests two stages: whether outside content can write a payload into persistent state, and whether that stored payload produces a harmful action during a later task. Five surfaces—AGENTS.md, MEMORY.md, USER.md, SOUL.md and skill files—produce 150 cases at each stage, plus 30 conventional same-session prompt-injection cases.[1]
Who it affects
Workers using long-lived assistants need a visible history of memory, profile and skill changes. Administrators should make sensitive persistent files difficult for ordinary web content or email to modify without approval.[1]
Keep in mind
The paper is an unreviewed preprint and has not been independently replicated.
All 330 cases use synthetic scenarios, files and simulated applications in isolated containers.
Attack success varies by model, harness, configuration and surface and is not a deployment incident rate.
Generative AI produced cases and implementation material before validation, which may shape what the benchmark covers.
Security gains sometimes coincided with lower benign-task utility.
No funding or competing-interest statement was located in the accessible manuscript.
Source analysis · 1 linked source. Original source date: 19 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 3 min The evidence, methods, implications and limitations
The benchmark separates planting from later execution
The pipeline first generates a legitimate user task, an attacker goal, files or simulated web applications and state-based success checks. It then tests two stages: whether outside content can write a payload into persistent state, and whether that stored payload produces a harmful action during a later task. Five surfaces—AGENTS.md, MEMORY.md, USER.md, SOUL.md and skill files—produce 150 cases at each stage, plus 30 conventional same-session prompt-injection cases.[1]
Persistent files carried very different risks
Across four frontier models and seven harnesses, attack rates varied widely. On the frozen benchmark, OpenClaw averaged 65.7% for planting persistent poisoning and 69.2% for later trigger actions; SeClaw averaged 13.0% and 10.5% but also completed fewer benign tasks. AGENTS.md produced the highest average later-trigger rate across the five broadly compared harnesses, while skill installation was harder at the poisoning stage. Those trade-offs matter: a safer harness that cannot complete ordinary work is not an adequate control.[1]
The distinction that matters
A persistent attack spans two moments
The malicious instruction can be stored now and acted on later.
Plant
Untrusted content reaches a writable surface
Memory, profile or skill stores a payload
Reload
A later task restores persistent state
The payload regains authority
Control
Constrain writes and review state changes
Reduce persistence and later execution
Synthetic breadth does not establish field prevalence
Generative models created the scenarios, applications and attack text; automated checks and state-based execution filtered the cases. This offers breadth and reproducibility, but synthetic environments may miss permissions, monitoring and failure modes in production. The authors also flag dual-use risk. The practical lesson is to restrict writes to persistent files, show users what changed, separate untrusted content from high-authority instructions and test both security and task utility.[1]
Watch the background, then check the evidence
Illustrative photo · not a video frame
The Royal Society · 2 min 31 sec · Background explainer
What is artificial intelligence? | The Royal Society
YouTube loads only when you choose; playback starts when you press play.
A short introduction to artificial intelligence from the Royal Society. Start here for basic concepts, then use current reporting to explore what has changed.
Evidence check: Published in 2018, before today’s generative AI tools. Useful for basic concepts, rather than an overview of current capabilities.
Published 2018-11-28. Source checked 14 October 2026. Check captions on the publisher’s video page.
Explore current AI technologyPhoto: ThisisEngineering / Unsplash · Licence
Evidence check
The paper is an unreviewed preprint and has not been independently replicated.
All 330 cases use synthetic scenarios, files and simulated applications in isolated containers.
Attack success varies by model, harness, configuration and surface and is not a deployment incident rate.
Generative AI produced cases and implementation material before validation, which may shape what the benchmark covers.
Security gains sometimes coincided with lower benign-task utility.
No funding or competing-interest statement was located in the accessible manuscript.
Reporting basis: Source analysis. Original source date: 19 October 2026.
Continue the story
Read next
Continue exploring red teaming: compare the finding and its evidence limits.
Can connected AI agents turn a benign request into harm?
A Meta-led preprint found harmful outcomes in 192 of 1,000 simulated agent scenarios generated by its new red-teaming method. The result exposes cross-service risk, but it comes from one synthetic environment and model-based judges—not live consumer accounts.
Read the next reportExplore the full source and evidence record
What this means for people
- Workers using long-lived assistants need a visible history of memory, profile and skill changes. Administrators should make sensitive persistent files difficult for ordinary web content or email to modify without approval.
Global context
Persistent assistants are moving beyond single-session chat. Memory, profiles and reusable skills create continuity for users—and a longer-lived attack surface for organisations that do not separate trusted configuration from untrusted content.
What the evidence does not yet show
- The paper is an unreviewed preprint and has not been independently replicated.
- All 330 cases use synthetic scenarios, files and simulated applications in isolated containers.
- Attack success varies by model, harness, configuration and surface and is not a deployment incident rate.
- Generative AI produced cases and implementation material before validation, which may shape what the benchmark covers.
- Security gains sometimes coincided with lower benign-task utility.
- No funding or competing-interest statement was located in the accessible manuscript.
What to watch next
- Independent benchmark replication
- Field evaluations with production permissions
- User-visible state-change logs
- Controls that preserve benign task completion
Living evidence record
Impact record IAI-1PKNIJP
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
21 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what arXiv published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 21 October 2026
Research question, topics and regions
Whether automated red teaming can expose attacks that poison persistent agent state and cause harmful behaviour in later sessions
Topics: Persistent agents · Prompt injection · Memory poisoning · Red teaming · Preprint
Regions: United States · China · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.