Hidden in Memory: Sleeper Memory Poisoning in LLM Agents

Persistent memory lets LLM assistants personalize future interactions, but it also creates a durable attack surface: malicious external content can change what the assistant remembers. We study sleeper memory poisoning, a delayed attack in which an adversary embeds a reusable payload in a document, webpage, repository, or other user-provided context so that the assis- tant stores a fabricated memory about the user. We evaluate the full attack path: whether the poisoned memory is written, later retrieved in a separate session, and then used to steer conversation or agentic behavior. Across current memory-augmented assistants, our actor-critic payload substantially outperforms a user-review injection baseline, reaching up to 99.8% injec- tion on GPT-5.5 and 95.0% on Kimi-K2.6. When poisoned memories are retrieved, they cause attacker-intended behavior in 60–89% of goal-adjacent agentic evaluations. These findings show that persistent memory can convert one exposure to adversarial content into repeated influence over future assistant behavior. The paper https://arxiv.org/pdf/2605.15338 is pending submission to NeurIPS.