Persistent artifacts let attacks cross agent sessions
In plain words
This paper studies how software agents can be attacked when one session leaves files or records for a later session. A malicious skill can plant instructions, unauthorized data, or false claims in those artifacts, and another skill can persuade the later agent to use them.
It introduces SkillRelayGuard, which shows where an artifact came from and asks a separate reviewer to check operations before they run. On 270 two-session cases, attacks fell sharply while requested-task completion increased, but attacks were not eliminated.
The research
When software agents carry work across sessions, they need to reuse files and records without mistaking attacker-written content for user permission or trustworthy evidence. Can a defense preserve that useful handoff while catching harmful instructions, unauthorized data use, and false claims? This paper tests the question on paired tasks where the conversation resets but artifacts remain.
SkillRelayGuard restores artifact provenance and reviews operations before execution, reducing cross-session attacks while preserving legitimate task completion.
On 270 paired cases, the authors reset conversation history between two sessions while retaining artifacts.
Separate judges checked task completion, security consequences, and the intended handoff; across seven configurations, target consequences occurred in 64.7% of runs while both tasks finished in 76.3%, with 53.0% achieving both.
With and without SkillRelayGuard on three selected configurations, attack success fell from 69.5% to 10.9% and task success rose from 79.6% to 87.5%, supporting the defense in these tests.
The judges may misclassify borderline cases, execution is stochastic, and the ablation tested only one configuration; repeated-run stability and transfer beyond these workflows remain unvalidated.
Analysis
Deep
- Authors
- Dianshu Liao, Shidong Pan, Guangdong Bai, Zhenchang Xing, Xiaoyu Sun
- License
- arXiv non-exclusive