AI RESEARCH
What If Prompt Injection Never Left? Exploring Cross-Session Stored Prompt Injection in Agentic Systems
arXiv CS.AI
•
ArXi:2606.04425v1 Announce Type: cross Modern agentic systems transform LLMs from session-bounded assistants into stateful systems that persist and evolve shared world state across sessions through memories, filesystems, tools, and other long-lived contextual artifacts. This shift fundamentally expands the attack surface of prompt injection. However, prior works on prompt injection have largely focused on model-level threats within a single session, overlooking how cross-session persistent system state fundamentally changes the system-level risk of agentic systems.