AgentPoison

MINJA plants a hijacking record in agent memory using only ordinary queries

The MINJA paper drops the usual assumption that an attacker can write to an agent's memory bank. A query interface and a prompt that shortens itself are enough to leave behind a record a later user's request retrieves.