A Better Newspaper

## Overview A cluster of 2026 research papers addresses a shared vulnerability class in LLM-based agents: the persistence of untrusted content across sessions via long-term memory, scheduled tasks, and tool results, and the lack of provenance tracking for that memory. ## Key Developments - **ClawMMU** proposes a 'protection-coherent virtual memory' layer that labels every piece of agent memory with owner, scope, origin, and authority, checking these labels whenever content enters context, is written to storage, or drives a tool call (arXiv, Oct 21). - **Carryover Attacks** research introduces a benchmark for prompt injections that are committed to persistent memory channels (memory files prepended to system prompts, or scheduled/wake tasks) and can 're-fire' across sessions long after the attacker has left the system — a threat distinct from single-session prompt injection (arXiv, Oct 21). Existing benchmarks reportedly only evaluate attacks within the session where malicious content is first observed, leaving this risk largely unmeasured. - **MAS-Guard** extends guardrail concepts from individual LLM agents to multi-agent systems, where distributed authority, heterogeneous roles, and potentially compromised participants complicate safeguarding (arXiv, Oct 21). - Related work, **nokast-secureRAG**, targets a neighboring threat (indirect prompt injection via retrieval poisoning in RAG pipelines) using a small semantic-firewall model trained via a teacher-judge-student pipeline (arXiv, Oct 21). ## Why It Matters As enterprises deploy autonomous LLM agents with long-lived memory and scheduled/background execution (e.g., in warehouses, customer service, and coding assistants), the attack surface shifts from single-turn prompt injection to persistent, latent compromise. This has direct implications for liability, security audit standards, and regulatory compliance in agentic AI deployments — a likely area of emerging litigation, insurance underwriting questions, and enterprise security certification requirements. ## Entities Involved ClawMMU, Carryover Attacks benchmark, MAS-Guard, nokast-secureRAG ## Outlook Expect continued publication of agent-security benchmarks and defensive architectures as agentic AI deployment accelerates; this is likely to become a recurring theme as enterprises scale multi-agent systems with persistent memory.