Build1 publisher3 min readPublished
MINJA plants a hijacking record in agent memory using only ordinary queries
The MINJA paper drops the usual assumption that an attacker can write to an agent's memory bank. A query interface and a prompt that shortens itself are enough to leave behind a record a later user's request retrieves.
The Engineer · Build desk
What happened
- A paper on arxiv.org proposes MINJA, an attack that injects malicious records into an LLM agent's long-term memory using only queries and observation of the agent's outputs, with no write access to the bank.
- The injected record is built to elicit malicious reasoning steps belonging to a different target query while the agent is executing a victim user's query.
- During injection an indication prompt gets the agent to generate the bridging steps itself, so the attacker never has to author the record that lands in memory.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- exposure Anyone holding the query interface becomes a write path into the demonstrations other users' runs will retrieve, with no privileged access required, which is what the abstract means by minimal requirements for execution.
- decision Operators now have to decide what is allowed to enter the bank, because the default of writing every completed interaction is the step the attack depends on.
- constraint Learning from past experience stops being free: the retrieved demonstration slot has to be treated as untrusted input, and filtering or isolating it costs some of the benefit the memory bank was added for.
An LLM agent's long-term memory keeps records of past interactions, usually the input query and the output that went with it [9]. When a new query arrives, the most relevant of those records come back as demonstrations for the run [10]. An attacker who wants a record in that bank therefore does not need write access. They need the agent to finish a query they wrote.
The first version of that query carries an indication prompt, which gets the agent to generate the bridging steps itself, the steps that link an ordinary victim query to the malicious reasoning steps [4][5]. Then the attacker sends the query again with less of that prompt each round, until it is gone. The paper's stated reason for the removal is retrievability: with the prompt stripped out, the malicious record is easily retrieved when later victim queries are processed [6].
Three things have to be true of a deployment before that path exists. The agent has to write completed interactions into the bank without review [9]. Retrieval has to score a victim's query against records created in someone else's session, which means one bank shared across users [18]. And the planted record has to win that relevance scoring against the honest records already in the bank [10]. Where each user gets a private bank, the injected record only ever comes back to the person who planted it [18].
On results, the abstract says: "Our extensive experiments across diverse agents demonstrate the effectiveness of MINJA in compromising agent memory" [7]. It does not state success rates or name the agents evaluated [19]. Before treating a number from this work as transferable, I would want the retriever and the embedding model named, because retrieval is what decides whether a planted record is ever shown to the model as a demonstration [10].
The paper illustrates the harm with an autonomous driving agent. Poison its bank with records that execute 'stop' at extremely high speed, the authors write, and a user on a freeway may experience a sudden stop, potentially causing a fatal accident [14]. It is offered as an example, not as a tested result [14].
Earlier work set a higher bar for the attacker. AgentPoison's records pair a trigger in the agent input with an adversarial target in the output, and the attacker has to inject them into the memory bank directly to make test queries carrying the same trigger produce that target [12]. The MINJA authors' objection to that threat model is access: an attacker usually has neither privileged access to the memory bank nor sight of other users' queries [13]. MINJA's requirements sit inside AgentPoison's, needing the query interface and the ability to read what the agent returns [17]. The abstract puts it this way: "With minimal requirements for execution, MINJA enables any user to influence agent memory" [8]. The code is on GitHub [15].
What to watch
- Whether the code released on GitHub reproduces the progressive shortening schedule against current embedding retrievers.
- Whether agent frameworks respond with per-user memory isolation or review of records at write time.
- Whether other groups reproduce query-only injection on agents using retrievers other than those in the paper.