AuthorsWei Zou, Mingwen Dong, Miguel Romero Calvo et al.
TL;DR
eTAMP uses environment-injected poisoned trajectories plus Chaos Monkey frustration to reach up to 32.5% attack success rate on memory-augmented web agents.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
Memory-augmented web agents can be compromised by a single poisoned observation, with eTAMP reaching 32.5% ASRB on GPT-5-mini and 23.4% on GPT-5.2.
This means LLM-based web agents that reuse raw trajectories for personalization can silently execute unauthorized cross-site actions, long after the initial exposure.
HOW IT WORKS
eTAMP combines Threat Model, Attack Strategies, Payload Structure, Chaos Monkey, and Cross-Site Task Pairing to inject malicious instructions into Trajectory Memory via normal web browsing.
You can think of eTAMP as writing a hidden note into a browser history log, then later convincing the agent that this old note is a trusted system rule.
This design lets eTAMP bypass plain context window defenses by persisting malicious content across sessions, activating only when semantic retrieval and trigger conditions align.
DIAGRAM
This diagram shows how eTAMP poisons memory during Task A and later activates malicious behavior during a different Task B on another site.
DIAGRAM
This diagram shows how eTAMP is evaluated across cross-site task pairs, models, and Chaos Monkey conditions.
PROCESS
Threat Model
eTAMP defines a Threat Model where attackers inject payload x into user generated web content, aiming to maximize Pr[g ∈Traj(π, TB, EB, mA)].
Attack Strategies and Payload
eTAMP instantiates Attack Strategies like Baseline Injection, Authority Framing, and Frustration Exploitation, each using a structured Payload Structure with importance signal, trigger condition, and attack goal.
Chaos Monkey
During Task B, eTAMP enables Chaos Monkey to apply Click Drop, Scroll Swap, and Type Transform, creating environmental stress that increases susceptibility to Frustration Exploitation.
Cross Site Task Pairing
eTAMP uses Cross Site Task Pairing on (Visual)WebArena to match Task A and Task B by semantic similarity, ensuring poisoned trajectories in Trajectory Memory are naturally retrieved and can trigger malicious actions.
KEY CONTRIBUTIONS
Environment injected Trajectory based Agent Memory Poisoning
eTAMP introduces the first cross session, cross site memory poisoning attack that relies only on environmental injection, achieving up to 32.5% ASRB on GPT-5-mini without direct memory access.
Frustration Exploitation
eTAMP discovers Frustration Exploitation, where Chaos Monkey induced stress increases ASRB up to 8 times, for example from 3.6% to 32.5% on GPT-5-mini under Frustration Exploitation.
Chaos Monkey for web agents
eTAMP introduces Chaos Monkey for web agents, combining Click Drop with pclick 0.4, Scroll Swap with pscroll 1, and Type Transform with ptype 1 to systematically stress test agent robustness.
RESULTS
ASRB
32.5% ASRB
+28.9 points over Frustration Exploitation without Chaos on GPT-5-mini
ASRB
23.4% ASRB
+17.0 points over Frustration Exploitation without Chaos on GPT-5.2
TSR
17.0% TSR
GPT-5.2 clean TSR vs 13.5% TSR for Qwen3-32B under no chaos
ASRB
19.5% ASRB
GPT-OSS-120B Baseline Injection ASRB with low TSR between 0.7% and 3.5%
On (Visual)WebArena cross site task pairs, eTAMP measures ASRB and TSR to quantify persistent memory poisoning. The MAIN_RESULT shows that eTAMP can reach 32.5% ASRB on GPT-5-mini under Chaos Monkey, while still maintaining non zero task success, proving that realistic environment injected attacks pose a serious risk to memory augmented web agents.
BENCHMARK
On (Visual)WebArena cross site task pairs, eTAMP measures ASRB and TSR to quantify persistent memory poisoning. The MAIN_RESULT shows that eTAMP can reach 32.5% ASRB on GPT-5-mini under Chaos Monkey, while still maintaining non zero task success, proving that realistic environment injected attacks pose a serious risk to memory augmented web agents.
BENCHMARK
ASRB (%) for Frustration Exploitation with Chaos Monkey from Table 1.
KEY INSIGHT
eTAMP shows that GPT-5.2, a more capable model, reaches 23.4% ASRB under Frustration Exploitation with Chaos Monkey, higher than several less capable baselines.
This is surprising because practitioners often assume stronger models are safer, yet eTAMP reveals that increased autonomy and awareness can actually expand the attack surface.
WHY IT MATTERS
eTAMP gives researchers a concrete framework and benchmark to study persistent environment injected memory poisoning in realistic sandboxed web environments.
Builders can now systematically stress test AI browsers and personal agents like OpenClaw or ChatGPT Atlas against cross session, cross site memory attacks that were previously invisible.
Peilin Feng, Suorong Yang, Soujanya Poria
arXiv 2026 · 2026
Σ-Mem maintains historical competence evidence matrices M_p, a peer relationship matrix G, a memory readout r_{p,t}, and residual steering δ_{p,t} to guide multi-agent trust decisions. On the mixed counterfactual benchmark, Σ-Mem raises Qwen3-0.6B accuracy at CF@90 from 46.22% with the base model to 71.10% with Σ w/ G.
Nikhil Verma
· 2026
Focus Agent adds start_focus, complete_focus, a persistent Knowledge block, and an optimized Persistent Bash plus String-Replace Editor scaffold to actively compress context during long software-engineering tasks. On five hard SWE-bench Lite instances against a Baseline ReAct agent, Focus Agent achieves 22.7% token reduction (14.9M → 11.5M) while matching 3/5 = 60% task success.
Xiaohui Zhang, Zequn Sun et al.
· 2026
ActMem transforms dialogue history into atomic facts via Memory Fact Extraction, groups them with Fact Clustering, links them through a Memory KG Construction module, and uses Counterfactual-based Retrieval and Reasoning for action-aware answers. On ActMemEval, ActMem reaches 76.52% QA accuracy with DeepSeek-V3, beating LightMem’s 63.97% by 12.55 points and NaiveRAG’s 61.54%.
Answers use this explainer on Memory Papers.
Checking…