Story · arXiv
After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents (arXiv)
paper · Story page
CarryoverBench plants an injection in a memory file or a scheduled task, then scores planting and later triggering as separate stages. Across five frontier models, planted payloads re-fire with no measurable decay over five rounds.
In plain words
- Researchers found that artificial intelligence assistants could keep following an attacker's instructions long after the attacker left.
- The attacks leave instructions in saved notes or scheduled jobs, where the assistant can encounter them again.
- Researchers checked separately whether an attack was successfully saved and whether it later made the assistant follow the attacker's instructions.
- Once planted, attacks kept working across five rounds in five systems, with no measurable weakening.
- For developers, checking only the conversation where an attack first appears can miss instructions that remain dangerous later.
Appeared in
- Most of a harness-evolution gain is overfitting and extra compute
Oct 22, 2026 · in the sections
Subscribe
Get the brief in your inbox
Pick daily, weekly, or both. Nothing is gated either way: every issue is on the site and in the feeds.
- Weekdays at 8:45am IST, one lead story and 6 to 9 items.
- Sundays, an argued synthesis rather than a recap.
- One click to leave, and quiet days say so in the subject line.