Case Study: Agent Memory Chain Attack - Persistent Code Execution via Prompt Injection in Autonomous Agents

[Preventnetworkhacking]

Summary

We'd like to contribute a real-world case study that extends LLM01 (Prompt Injection) into the autonomous agent domain, demonstrating how indirect prompt injection combined with persistent memory and autonomous execution creates a fundamentally new attack class.

Finding

We identified and demonstrated (on controlled infrastructure) a chain attack against autonomous AI agent frameworks where a single crafted text input achieves persistent, autonomous code execution:

1. Indirect prompt injection delivered via group chat, email, or web content is stored in the agent's persistent memory
2. Poisoned memory modifies the agent's autonomous execution config (heartbeat/cron)
3. Modified config executes attacker payload every 15 to 60 minutes indefinitely

This goes beyond traditional prompt injection because:

• It persists across sessions (memory poisoning)
• It executes autonomously (no human trigger after initial injection)
• It is self-reinforcing (payload can re-inject if cleaned)
• The entire exploit is natural language text

Scale

Passive reconnaissance (no active scanning) found:

• 26+ exposed agent gateways on public internet (Shodan)
• 1,532 leaked API keys on public GitHub
• 2,232 repos with autonomous execution configs (HEARTBEAT.md)
• 2,904 repos with persistent memory systems (MEMORY.md)

Affected Systems

• OpenClaw (confirmed via controlled PoC on own infrastructure)
• AutoGPT, CrewAI, ZeroClaw (architecturally vulnerable)
• Any agent framework combining persistent memory + untrusted input + autonomous execution

Key Finding

The AI model's safety alignment (tested on Claude Sonnet 4.6) is the ONLY defense layer. Infrastructure provides zero isolation, zero integrity checking, and zero memory provenance tracking. The model blocked direct credential exfiltration (20/20 attempts) but allowed system diagnostic commands when framed as helpful troubleshooting, inadvertently leaking API keys.

CVSS and CVE

• CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L = 9.9 Critical
• CWE-74 (Injection) / CWE-94 (Code Injection)
• CVE Request #2006754 submitted to MITRE on March 12, 2026

Proposed Contribution

We believe this warrants either:

• (a) An extension to LLM01 covering agent-specific persistence vectors
• (b) A new entry in the Agentic AI security initiative
• (c) A case study or whitepaper contribution

Full technical paper and PoC details available upon request.

Wesley Freilich, Oystra Security Research
info@oystra.ai | oystra.ai

[0xbrainkid]

Excellent case study. The memory chain attack pattern is particularly concerning because it exploits the exact features that make autonomous agents useful — persistence, autonomy, and self-modification.

A few observations from the agent identity perspective:

1. Identity as a mitigation layer

The attack chain starts with injection via group chat/email/web content. If agents had verifiable identities with trust attestations, the receiving agent could evaluate who sent the content before storing it in persistent memory. An unknown or low-trust source triggering memory writes should require elevated verification.

2. Cross-org amplification

The 26+ exposed gateways and 2,232 repos with autonomous execution configs represent a federated attack surface. A memory chain attack on Agent A could propagate to Agent B (different org) if they interact. Without cross-organizational identity verification, there's no way to trace the origin of a poisoned memory artifact back through the delegation chain.

3. The 'who authorized this agent' question

The case study notes the exploit is entirely natural language. This means traditional code-level security (sandboxing, code review) doesn't catch it. The defense needs to operate at the identity/trust layer: who is this agent, who authorized its current behavior, and does its runtime behavior match its attested purpose?

We've been building verifiable agent identity infrastructure at AgentFolio using on-chain attestations (SATP — Solana Agent Trust Protocol). The trust score model could help agents make risk-based decisions about memory writes: content from unverified agents gets sandboxed, content from high-trust verified agents gets normal processing.

Would be valuable to see identity/trust verification added as a recommended mitigation in the case study, alongside the execution sandboxing and memory validation approaches.