Persistent Semantic Entities in Tool-Augmented LLM Systems
Preference and instruction contamination---persistent, lacking self-correction, and poorly captured by standard monitoring---represent a particularly concerning attack surface for deployed agent systems.