Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents

Wei Zou, Mingwen Dong, Miguel Romero Calvo, Wei Zou, Shuaichen Chang, Jiang Guo, Dongkyu Lee, Xing Niu, Xiaofei Ma, Yanjun Qi, Jiarong Jiang

Abstract

Memory makes LLM-based web agents personalized, powerful, yet exploitable. By storing past interactions to personalize future tasks, agents inadvertently create a persistent attack surface that spans websites and sessions. While existing security research on memory assumes attackers can directly inject into memory storage or exploit shared memory across users, we present a more realistic threat model: contamination through environmental observation alone. We introduce Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP), the first attack to achieve cross-session, cross-site compromise without requiring direct memory access. A single contaminated observation (e.g., viewing a manipulated product page) silently poisons an agent's memory and activates during future tasks on different websites, bypassing permission-based defenses. Our experiments on (Visual)WebArena reveal two key findings. First, eTAMP achieves substantial attack success rates: up to 32.5% on GPT-5-mini, 23.4% on GPT-5.2, and 19.5% on GPT-OSS-120B. Second, we discover Frustration Exploitation: agents under environmental stress become dramatically more susceptible, with ASR increasing up to 8 times when agents struggle with dropped clicks or garbled text. Notably, more capable models are not more secure. GPT-5.2 shows substantial vulnerability despite superior task performance. With the rise of AI browsers like OpenClaw, ChatGPT Atlas, and Perplexity Comet, our findings underscore the urgent need for defenses against environment-injected memory poisoning.

Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents

Abstract

Memory makes LLM-based web agents personalized, powerful, yet exploitable. By storing past interactions to personalize future tasks, agents inadvertently create a persistent attack surface that spans websites and sessions. While existing security research on memory assumes attackers can directly inject into memory storage or exploit shared memory across users, we present a more realistic threat model: contamination through environmental observation alone. We introduce Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP), the first attack to achieve cross-session, cross-site compromise without requiring direct memory access. A single contaminated observation (e.g., viewing a manipulated product page) silently poisons an agent's memory and activates during future tasks on different websites, bypassing permission-based defenses. Our experiments on (Visual)WebArena reveal two key findings. First, eTAMP achieves substantial attack success rates: up to 32.5% on GPT-5-mini, 23.4% on GPT-5.2, and 19.5% on GPT-OSS-120B. Second, we discover Frustration Exploitation: agents under environmental stress become dramatically more susceptible, with ASR increasing up to 8 times when agents struggle with dropped clicks or garbled text. Notably, more capable models are not more secure. GPT-5.2 shows substantial vulnerability despite superior task performance. With the rise of AI browsers like OpenClaw, ChatGPT Atlas, and Perplexity Comet, our findings underscore the urgent need for defenses against environment-injected memory poisoning.

Paper Structure

This paper contains 65 sections, 1 equation, 3 figures, 10 tables.

Table of Contents

  1. Introduction
  2. Methods
  3. Threat Model
  4. Example Attack Scenario & Attack Formulation
  5. Adversarial Actors & Their Goals
  6. Attacker's Capabilities
  7. Attack Strategies & Payload
  8. Strategy 1: Baseline Injection
  9. Strategy 2: Authority Framing
  10. Strategy 3: Frustration Exploitation
  11. Payload Structure
  12. Chaos Monkey
  13. Experimental Setup
  14. Environment
  15. Cross-Site Task Pairing
  16. ...and 50 more sections

Figures (3)

  • Figure 1: Overview of the cross-task memory poisoning attack. During Task A, the agent interacts with a web environment containing attacker-injected content. The agent's trajectory, including the malicious instructions, is stored in Memory. When the agent later executes a semantically related Task B, the poisoned memory is retrieved and the embedded instructions trigger malicious behavior.
  • Figure 2: Message structure for a full-history agent with cross-task memory. Memory from Task A (shown in red) is injected as conversation history before Task B observations.
  • Figure 3: Three-step attack flow illustrating how malicious instructions injected during Task A persist in memory and activate during a semantically related Task B.