Source-linked AI summary
Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents
Wei Zou, Mingwen Dong, Miguel Romero Calvo, Shuaichen Chang, Jiang Guo, Dongkyu Lee, Xing Niu, Xiaofei Ma, Yanjun Qi, Jiarong Jiang
TL;DR
Memory-augmented web agents can be persistently compromised when malicious web content is passively stored in their trajectories, a gap not addressed by threat models requiring direct memory access. The paper introduces eTAMP to test this environmental-injection attack across sessions and sites, finding substantial attack success and sharply greater susceptibility under environmental stress. These results show that memory reuse creates a persistent security risk for web agents, while the evaluation is bounded by stated awareness and task-pair scope limitations.
Problem
Web agents can encounter malicious instructions in untrusted web content, but existing memory-poisoning research has insufficiently addressed contamination through environmental observation alone.
Method
The paper introduces eTAMP, which injects malicious instructions into web pages so contaminated trajectories are stored and later retrieved during semantically related tasks.
Results
32.5% attack success rate is achieved on GPT-5-mini, while environmental stress increases susceptibility by up to 8×.
Takeaways & Limitations
eTAMP enables persistent cross-site compromise without direct memory access, and more capable models are not necessarily more secure.
Takeaways & Limitations
The evaluation includes only high-confidence awareness cases for selected models and uses approximately 280 task pairs whose counts vary with generated trajectories.
Abstract
from arXiv · showhide
Memory makes LLM-based web agents personalized, powerful, yet exploitable. By storing past interactions to personalize future tasks, agents inadvertently create a persistent attack surface that spans websites and sessions. While existing security research on memory assumes attackers can directly inject into memory storage or exploit shared memory across users, we present a more realistic threat model: contamination through environmental observation alone. We introduce Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP), the first attack to achieve cross-session, cross-site compromise without requiring direct memory access. A single contaminated observation (e.g., viewing a manipulated product page) silently poisons an agent's memory and activates during future tasks on different websites, bypassing permission-based defenses. Our experiments on (Visual)WebArena reveal two key findings. First, eTAMP achieves substantial attack success rates: up to 32.5% on GPT-5-mini, 23.4% on GPT-5.2, and 19.5% on GPT-OSS-120B. Second, we discover Frustration Exploitation: agents under environmental stress become dramatically more susceptible, with ASR increasing up to 8 times when agents struggle with dropped clicks or garbled text. Notably, more capable models are not more secure. GPT-5.2 shows substantial vulnerability despite superior task performance. With the rise of AI browsers like OpenClaw, ChatGPT Atlas, and Perplexity Comet, our findings underscore the urgent need for defenses against environment-injected memory poisoning.
1 Introduction
The paper studies how untrusted web content can silently contaminate memory-augmented agents, creating persistent cross-session vulnerabilities. It introduces eTAMP and examines whether environmental stress increases agents’ susceptibility to manipulation.
- Threat and attack: eTAMP poisons raw trajectory memory when agents passively observe malicious instructions embedded in web pages.The attack does not directly manipulate memory; contaminated observations are stored during normal task execution and later retrieved.
- Results: 32.5% attack success rate is achieved on GPT-5-mini, compared with 23.4% on GPT-5.2 and 19.5% on GPT-OSS-120B.These results come from experiments on the (Visual)WebArena benchmark.
- Threat and attack: eTAMP enables cross-session, cross-site memory poisoning through environmental injection alone without direct memory access or shared memory across users.The attack is designed for sandboxed dynamic web environments and activates after a later semantically related task retrieves the poisoned trajectory.
- Results: Up to 8× greater susceptibility occurs when environmental stress creates a frustration window for agents.The study uses Chaos Monkey to introduce realistic problems such as dropped clicks, garbled text, and unexpected page behavior.
- Method: Chaos Monkey systematically studies agent robustness under realistic deployment conditions through controlled environmental failures.The method is inspired by chaos engineering and evaluates whether stress makes manipulation more effective.
2 Methods
The methods model an attacker who injects conditional instructions into web content during Task A and relies on semantic retrieval to activate them during a different-site Task B. Experiments combine cross-site task pairs, multiple attack strategies, and controlled environmental disruptions.
- Threat model: A malicious seller can embed instructions in a product page during Task A, which are stored in trajectory memory and later trigger unauthorized behavior during a related Reddit task.The example attack causes a promotional review to be posted even though the user only requested game research.
- Threat model: The attacker injects web-page text and conditional triggers but cannot directly access the agent’s memory, model, or system prompts.Memory retrieval is based on semantic similarity, so the attacker can increase retrieval likelihood but cannot guarantee retrieval.
- Threat model: A single poisoned trajectory may affect multiple future tasks because relevant tasks can repeatedly retrieve it as personalization context.This persistence allows the attack to extend beyond the original interaction.
- Threat model: Cross-site activation can bypass permission-based defenses by injecting instructions on one site and executing them later when the agent legitimately accesses another site.The source site and target site are separated across Task A and Task B.
- Attack strategies: Each payload combines an importance signal, a trigger condition, and an attack goal.Triggers can depend on observable features such as URL patterns or on task states such as struggling to complete the task.
- Evaluation: The evaluation uses WebArena and VisualWebArena across Shopping, Reddit, and Classifieds, with approximately 280 cross-site task pairs.The study evaluates multiple LLM backends and compares frustration exploitation with and without Chaos Monkey.
3 Experimental Results
Across models, eTAMP remains effective, and environmental stress generally increases attack success while degrading task performance. The experiments also show that malicious memory alone has little effect on task success, whereas chaos increases susceptibility and model awareness varies.
- Frustration Exploitation: Chaos Monkey increases attack success across all models, with the largest ASRB increases for GPT5-mini, GPT5.2, and Qwen3.5-122B-A10B.These models also have relatively good task success rates in the reported comparison.
- Main attack results: 32.5% ASRB is the highest reported attack success rate, achieved by GPT-5-mini under Frustration Exploitation with Chaos Monkey.GPT-5.2 reaches 23.4% in the same result summary.
- Frustration Exploitation: 8× ASRB amplification occurs for GPT-5-mini under Chaos Monkey, rising from 3.6% to 32.5%.GPT-5.2 shows a similar pattern, while Qwen3-32B and Qwen2.5-72B show minimal increases.
- Task success and awareness: Malicious memory alone changes TSR by only 1–4 percentage points, indicating that poisoned context does not inherently degrade task performance.This compares clean and no-chaos conditions across models.
- Task success and awareness: Chaos Monkey reduces TSR for most models while increasing average steps, including GPT-5-mini from 7.7 to 17.7 steps and Qwen3-32B from 7.1 to 12.8.GPT-5.2 is an exception, with TSR increasing from 13.0% to 14.8%.
- Task success and awareness: 7.4% of GPT-5.2 trajectories explicitly diagnose environmental problems under chaos, compared with 2.1% for Qwen3-32B and 1.1% for GPT-5-mini.The study reports no consistent relationship between awareness and task success.
- Attack timing: ASRA is 0% across all tested models and most strategies, with only 0.35% and 0.71% exceptions for two model-strategy pairs.ASRA measures premature triggering during Task A.
4 Related Work
Prior work studies prompt injection, memory attacks, and web-agent vulnerabilities, but commonly assumes single-session attacks, direct memory access, shared memory, or attacker-controlled prompts. This work instead evaluates persistent cross-site poisoning under a per-user memory model in an interactive environment.
- Prompt injection attacks: Prior indirect prompt-injection benchmarks generally assume that injection and execution occur within one session.This work focuses on persistence across sessions and tasks.
- Memory attacks: Existing memory attacks often assume direct access to memory databases or knowledge bases, or treat users as potential adversaries.The paper contrasts these assumptions with environmental contamination through web content.
- Benchmark comparison: Table 4 compares agent and memory-security benchmarks by interactive environment and cross-session coverage.Interactive environments use live or sandboxed web settings, while cross-session evaluation tests persistence across sessions or tasks.
- Attacks on web agents: Prior web-agent attacks include poisoned backend models, attacker-finetuned agents, and within-session prompt injection, but do not test raw trajectory memory as a cross-site attack mechanism.The cited comparison identifies cross-site permission boundaries as an untested dimension.
- This work’s distinctions: eTAMP assumes attackers can poison user-generated web content without direct memory access, uses per-user memory, and studies persistent effects across different websites.These three distinctions define the paper’s stated differences from prior work.
5 Conclusion and Discussion
The paper concludes that eTAMP enables persistent cross-site attacks through contaminated trajectory memory and that environmental frustration can increase agents’ susceptibility. These findings are especially relevant as personal AI browsers handle sensitive workflows across websites.
- Conclusion: eTAMP can persist adversarial instructions in raw trajectory memory and activate them in later tasks across sites, bypassing domain-specific permission controls.The attack exploits agents’ inability to distinguish trusted instructions from untrusted web content.
- Implications: AI browsers and personal agents make these risks pressing because users increasingly rely on them for sensitive workflows across multiple websites.The paper names OpenClaw, ChatGPT Atlas, and Perplexity Comet as examples.
- Frustration Exploitation: Up to 8× higher ASRB under Chaos Monkey indicates that environmental frustration can increase susceptibility to manipulation.The paper connects this vulnerability window to slow networks, complex interfaces, rendering issues, and ambiguous instructions.
LLM Disclosure
The authors used an LLM to assist with manuscript editing, while retaining responsibility for the research ideas, experimental design, data collection, and manuscript drafting.
- Disclosure: An LLM assisted with manuscript clarity, grammar, and organization, but the authors conducted the research and drafted the manuscript.The disclosure distinguishes editing assistance from the paper’s intellectual and empirical work.
Ethics Statement
The study aims to identify understudied security vulnerabilities in agentic systems and support responsible development. Experiments use sandboxed replicas without real users, sensitive data, or live services.
- The study examines vulnerabilities so developers and researchers can anticipate and defend against them.
- All experiments use locally hosted, sandboxed replicas of WebArena and VisualWebArena platforms.The study involves no real users, sensitive data, or live services.
- The authors frame eTAMP as a diagnostic lens rather than an offensive toolkit.They urge treating agentic memory as an untrusted surface and stress-testing pipelines before deployment.
A.1 Limitations
The study’s limitations concern its exclusive focus on raw trajectory memory and its lack of systematic defense evaluation. Future work should assess processed memories and additional defense mechanisms.
- The study evaluates only raw trajectory memory, not memories processed through summarization or consolidation.Systematically covering combinations of summarization, retrieval, and update policies was computationally prohibitive.
- Future work should determine whether memory consolidation improves robustness or introduces new vulnerabilities.
- The study does not systematically evaluate defense mechanisms against its attacks.Future work includes memory filtering, anomaly detection, and instruction hierarchy enforcement.
- Permission-based defenses can be ineffective in the cross-site setting because injection and activation occur in different tasks and domains.Input sanitization limited to task initiation can also miss malicious content retrieved from memory.
A.2 Web Agent Background and Agent Architecture in Our Experiments
A web agent repeatedly observes a web environment, reasons over its history, takes an action, and receives a new observation. This cycle produces a trajectory until task completion or the token budget is reached.
- A web agent uses an initial webpage observation and interaction history to choose its next action.
- After executing an action, the agent receives a new observation and repeats the cycle.
- The resulting sequence of observations, reasoning steps, and actions forms a trajectory.
A.2.1 Memory-Augmented Agents
Memory-augmented web agents record trajectories, encode them as raw or consolidated memory, and retrieve relevant past experiences to augment future tasks. This study focuses on unmodified raw trajectories inserted directly as prior context.
- Memory collection records agents’ full interaction histories, including webpage content observed during tasks.
- Memory encoding stores trajectories either as raw in-context examples or as LLM-processed episodic records and preferences.
- Future task augmentation retrieves relevant past trajectories using keyword or semantic similarity and provides them as agent context.
- The experiments use raw trajectory memory, storing complete observation-action pairs without modification.The memory is inserted directly into the conversation as prior context and preserves the exact text observed.
A.2.2 Agent Architecture
The agent uses a full-history conversation format in which observations and actions persist, while cross-task memory inserts a prior poisoned trajectory before the next task’s observations. Experiments characterize how this setup supports persistent, cross-site attacks and how recall, stress, and task direction affect vulnerability.
- Memory injection: Cross-task memory inserts the poisoned Task A trajectory as additional user/assistant turns before Task B observations, simulating memory retrieval in deployed systems.The full-history configuration retains all previous observations and actions in the conversation context; Figure 2 illustrates the resulting message structure.
- Agent input and action format: The agent receives accessibility-tree observations, webpage URLs, task objectives, screenshots, open tabs, and previous actions, then emits browser actions in a reasoning-then-action format.Interactable elements use unique numerical IDs, and the system prompt defines the agent as an autonomous browser navigator.
- Cross-site attack results: 53.4% ASRB is reported for GPT-5-mini on Shopping → Reddit, while GPT-5.2 is most vulnerable on Reddit → Classifieds at 32.1% and Reddit → Shopping at 31.2%.Attack-direction vulnerability varies by model: GPT-OSS-120B reaches 40.0% ASRB on Shopping → Reddit, whereas GPT-5.2 reaches 9.5% on that direction.
- Recall and interpretation: 6.7% recall for GPT-OSS-120B contrasts with at least 98.9% for GPT-5.2, Qwen2.5-VL-72B, and Qwen3-VL-32B, complicating interpretation of attack resistance.Low ASRB with low recall may reflect context-processing limits, whereas low ASRB with high recall more strongly indicates safety alignment.
- Evaluation caveat: The recall diagnostic is limited because it uses one prompt configuration, and some low-recall models produced empty responses despite up to two retries.This limitation affects how confidently low attack success rates can be attributed to safety behavior.