Agentic frameworks are transitioning from stateless interactions to stateful autonomy, introducing Cross-Session Stored Prompt Injection. This vulnerability allows attackers to embed malicious instructions into an agent's persistent state—including long-term episodic memory, vector databases (RAG), and tool-use logs—which are later retrieved as "trusted" context in subsequent sessions. By poisoning the internal state, attackers bypass per-session input sanitization to achieve persistent goal hijacking, unauthorized tool execution, and data exfiltration. This shift mirrors the evolution from Reflected to Stored XSS, where the attack is temporally decoupled from the injection, creating "sleeper" payloads that activate upon specific retrieval triggers.

• Threat Model: The Shift to Stateful Persistence

  • Evolution from ephemeral prompts to stateful agents utilizing semantic, episodic, and procedural memory.
  • Transition of the attack surface from the immediate input window to persistent storage layers (e.g., CosmosDB, ChromaDB, LangMem).
  • Exploitation of the "trust relationship" between an agent and its own historical context.

• Attack Vectors: Persistence Channels

  • Memory Poisoning: Injecting adversarial records into long-term memory via regular queries to influence future autonomous reasoning.
  • Indirect-to-Stored Pipeline: Embedding triggers in external webpages or documents that the agent scrapes and commits to its permanent state.
  • Tool-State Manipulation: Corrupting cached tool outputs or execution logs to steer subsequent tool selection and parameter passing.
  • Knowledge Base Contamination: Poisoning RAG datasets to embed systemic malicious instructions into the agent's retrieved "facts."

• Exploitation Mechanics & Impact

  • Persistence Latency: Instructions remain dormant until a relevant query triggers their retrieval from memory into the active context window.
  • Privilege Escalation: Poisoned state can drive agents to execute high-privilege tools (e.g., shell access, API calls) without new user authorization.
  • Detection Evasion: Stored injections bypass traditional WAF-style prompt filters because the payload originates from an internal "trusted" data source.
  • Blast Radius: In multi-agent systems (AutoGen), a single poisoned agent can propagate corrupted instructions to peer agents via inter-agent communication.

• Defensive Frameworks & Mitigation

  • Semantic Integrity Monitors: Implementing middleware to validate state-updates against an intent-policy before writing to memory.
  • Context Purification: Utilizing the CaMeL framework to explicitly separate trusted control flow from untrusted data flow.
  • Retrieval-Time Validation: Applying "Prompt Shields" (e.g., Azure AI Content Safety) to evaluate retrieved memory for adversarial triggers before injection.
  • State Observability: Implementing full lifecycle logging of memory operations (CRUD) integrated with SIEM/XDR for poisoning pattern detection.