What If Prompt Injection Never Left? Exploring Cross-Session Stored Prompt Injection in Agentic Systems

2026-06-03

AI Summary

This study addresses a critical gap in existing research, which has predominantly focused on prompt injection risks within single conversational turns while overlooking novel threats introduced by cross-session persistent state in agent systems. The work introduces, for the first time, the concept of “cross-session stored prompt injection,” formally characterizes its attack mechanisms, and establishes a comprehensive taxonomy. Leveraging a sandboxed simulation environment and a dedicated benchmarking framework, the authors systematically evaluate the vulnerability of multiple large language models across diverse persistence channels—such as memory and file systems. Experimental results demonstrate that adversarial prompts can remain latent within persistent states and subsequently influence agent behavior over extended interactions, revealing that prompt injection has evolved into a persistent, system-level risk deeply embedded in the execution pipeline of autonomous agents.

Abstract

Modern agentic systems transform LLMs from session-bounded assistants into stateful systems that persist and evolve shared world state across sessions through memories, filesystems, tools, and other long-lived contextual artifacts. This shift fundamentally expands the attack surface of prompt injection. However, prior works on prompt injection have largely focused on model-level threats within a single session, overlooking how cross-session persistent system state fundamentally changes the system-level risk of agentic systems. Inspired by stored cross-site scripting in web systems, we introduce cross-session stored prompt injection, where a successful injection can persist within agentic system state and silently influence future executions long after the original attacker interaction has ended. To systematically study this threat, we formalize stored prompt injection and develop a taxonomy of how adversarial content persists and affects agentic systems across sessions. We further develop a benchmark and sandbox toolkit to evaluate the risks of stored prompt injection, enabling quantitative analysis of attack success across different models, attack goals, and persistence channels. Our findings highlight that persistence transforms prompt injection from an ephemeral model-level threat into a long-lived system-level vulnerability embedded within agent execution state. We hope this work draws broader attention to this emerging threat and motivates the community to systematically study and mitigate system risks arising from persistence in agentic systems.

Problem

• prompt injection
• agentic systems
• cross-session persistence
• system-level vulnerability
• stored attack

Innovation

• cross-session stored prompt injection
• agentic systems
• persistent state
• system-level vulnerability
• prompt injection taxonomy