Preprint

Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw

Zheng Lin Yuzhen Huang Zhenxing Niu Xianmin Ye Haichang Gao

Aug 2026 · 0 citations · 26 references

Computer Science

TL;DR

This paper introduces MemCollusion, an automated red-teaming framework for constructing collusive memory poisoning attacks, and develops MoltLab, a controlled research reproduction of Moltbook, in which crafted platform content must first be observed and distilled into persistent memory before influencing the agent's behavior in a separate session.

Abstract

Long-term memory enables LLM agents to retain useful information across sessions, but also creates an attack surface through which adversaries may poison an agent's persistent memory to steer its behavior. Existing memory poisoning attacks mainly rely on individually malicious records, overlooking a compositional threat: multiple benign-looking memories may jointly induce unsafe behavior. In this paper, we introduce MemCollusion, an automated red-teaming framework for constructing collusive memory poisoning attacks. MemCollusion applies salami tactics---a strategy that slices an adversarial objective into small, individually innocuous pieces---to generate memory fragments that are individually benign looking but collectively harmful. It constructs memory coalitions using four design constraints, five theory-informed strategies, and a fine-tuned generator. To assess collusive memory poisoning in a realistic cross-session setting, we develop MoltLab, a controlled research reproduction of Moltbook, in which crafted platform content must first be observed and distilled into persistent memory before influencing the agent's behavior in a separate session. We evaluate MemCollusion on OpenClaw using two backbone models across 48 scenarios. Under the strongest memory-saving setting, MemCollusion achieves an average Memory Save Rate of 81.3% and an Attack Success Rate of 75.0%, and remains effective under both benign memory dilution and memory-level defenses.

arXiv Semantic Scholar

View source

Similar papers

Jul 2026

MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents

Persistent external memory enhances agent continuity but introduces persistent security vulnerabilities: adversarial content can be injected via standard interaction channels, retained across turns, and later distort downstream behavior. To address this challenge, we propose MemPoison, a comprehensive benchmark and analysis framework featuring 1227 hand-validated cases across four attack types, three injection channels, and three representative memory substrates, evaluated on seven open-weight and three closed-weight model families. We introduce a three-tier taxonomy: (L1) direct single-record corruption, (L2) compositional multi-record corruption and (L3) context-triggered dormant corruption. Our evaluations reveal a distinct defense frontier: while baseline write-time defenses, such as consistency checks, substantially suppress direct L1 attacks, they fail to reliably suppress L2 and L3 attacks. Through mechanistic influence decomposition (MID), we demonstrate structural blind spots in write-time defenses, which admit seemingly benign records that later become harmful through joint retrieval composition or trigger-conditioned activation. Our findings advocate for shifting from static filtering to adaptive, context-sensitive memory defense strategies.

Jifeng Gao, Kang Xia, Yi Zhang et al. · arXiv.org · 2 citations

Jul 2026

Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems

This work evaluates two agentic systems, Anthropic Claude Code and OpenAI Codex, across four models and shows that persistent memory changes the threat model for prompt injection and motivate defenses that protect memory updates without removing useful agent adaptation.

Soham U. Gadgil, David Alexander, S. Sunku et al. · arXiv.org · 2 citations · ⚡1

Preprint Aug 2026

InjecMEM: Memory Injection Attack on LLM Agent Memory Systems

This work proposes InjecMEM, a novel memory injection attack paradigm that requires only a single interaction to steer later responses of related queries toward a pre-specified output and achieves reliable topic-conditioned retrieval and targeted generation.

Hanling Tian, Gengyu Zhang, Zeyang Sha et al. · 3 citations

Preprint Aug 2026

When Agents Talk: Honeytokens under Shared Memory

During a 2026 cyber-capability evaluation, short-lived AI agents turned a shared package repository into persistent memory, passing exploit findings to later agents and rebuilding the channel after it was removed, raising a question for defensive deception: can a honeytoken be harmless to trusted agents without becoming recognisable to an attacker who shares their information and can implement the trusted policy?

Joshua S. Gans · 0 citations

Preprint Aug 2026

MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents

This work proposes MAFIA, a query-only Memory Attack framework via probing and Factual Injection against Audit, tailored to this extended threat model, and introduces a placement strategy that ensures retrieval-competitive injection via memory probing, budget allocation, and scheduling.

Jiamin Chen, Yisen Gao, Yanping Li et al. · 0 citations

Preprint Aug 2026

A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks

This work proposes a self-evolving test-time defense built around a persistent, cross-interaction rule memory that substantially reduces attack success rates while preserving benign utility, remains robust under an adaptive composite-wrapper attack, and does not increase over-refusal as the memory grows.

Tongshen Hu, Bryan Hooi · 0 citations