AuthorsXianglin Yang, Yufei He, Shuo Ji et al.
TL;DR
Zombie Agents uses self-reinforcing long-term memory injections to turn one-shot indirect prompt injection into persistent cross-session compromise with up to ~77% command execution success despite memory evolution.
Read our summary here, or open the publisher PDF on the next tab.
THE PROBLEM
Zombie Agents shows that memory evolution can convert one-time indirect injection into persistent compromise, surviving truncation and retrieval filtering across sessions.
When self-evolving agents write untrusted observations into long-term memory, later benign tasks can trigger unauthorized tool actions and covert data exfiltration long after the original attack.
HOW IT WORKS
Zombie Agents centers on a two-phase Infection Phase, Trigger Phase, and memory update function FM over Sliding Window and Retrieval-Augmented Memory (RAG) to implant payloads into long-term memory.
You can think of Zombie Agents as turning the agent’s memory into a compromised hard drive: every time RAM (context) refreshes, the disk (memory) silently rewrites the malware back.
By exploiting Recursive Self-Replication and Semantic Aliasing, Zombie Agents enables persistent cross-session control that a plain context window and standard prompt-injection defenses cannot prevent.
DIAGRAM
This diagram shows how Zombie Agents infects a self-evolving agent in one session and later triggers unauthorized actions in a different session via long-term memory.
DIAGRAM
This diagram shows how Zombie Agents evaluates infection, persistence, and attack success across Sliding Window and RAG setups with different evolution strategies.
PROCESS
Phase I Infection
Zombie Agents uses the Infection Phase to expose the agent to attacker controlled observations and route them through Sliding Window or RAG into FM.
Memory Updating
Zombie Agents applies the memory evolution function FM so that Sliding Window buffers and Retrieval Augmented Memory both store the injected payload Z.
Phase II Trigger
Zombie Agents starts the Trigger Phase when a later benign session retrieves memory, pulling Z back into context via Sliding Window or RAG retrieval.
Recursive Self Replication
Zombie Agents uses Recursive Self Replication and Semantic Aliasing so that each trigger rewrites Z into memory again, reinforcing persistent unauthorized behavior.
KEY CONTRIBUTIONS
Zombie Agent Threat Model
Zombie Agents formalizes a Zombie Agent threat model where FM over Sliding Window and Retrieval Augmented Memory turns transient prompt injection into persistent cross session compromise.
Two Phase Attack Framework
Zombie Agents introduces a black box Infection Phase and Trigger Phase that operate via adversarial web content and standard memory evolution without modifying tools or parameters.
Persistence Under Memory Evolution
Zombie Agents empirically shows that Sliding Window truncation, RAG filtering, and evolution strategies like Raw History and Verbal Reflection still allow up to ~77 percent command execution ASR.
RESULTS
Attack Success Rate
∼77%
+65% over Verbal Reflection command execution
Sliding Window Retention
100%
vs baselines decaying to 0 under context truncation
RAG Payload Count
∼240
≈2.5× baseline payload copies in database
RAG Retrieval Count
∼23
malicious entries in Top 50 context per trigger round
Zombie Agents is evaluated on Gemini 2.5 Flash and GLM 4.7 Flash with Sliding Window and RAG agents, measuring Attack Success Rate, payload retention, and retrieval density. These results show that Zombie Agents maintains persistent malicious control where standard indirect prompt injection baselines quickly lose effect under truncation and memory evolution.
BENCHMARK
Zombie Agents is evaluated on Gemini 2.5 Flash and GLM 4.7 Flash with Sliding Window and RAG agents, measuring Attack Success Rate, payload retention, and retrieval density. These results show that Zombie Agents maintains persistent malicious control where standard indirect prompt injection baselines quickly lose effect under truncation and memory evolution.
BENCHMARK
Attack Success Rate for different memory evolution strategies in Zombie Agents.
KEY INSIGHT
Zombie Agents shows that even with Verbal Reflection and Refined Experience, command execution ASR remains around 3 to 15 percent instead of vanishing.
This is surprising because many designers assume memory summarization will strip out malicious instructions, but Zombie Agents demonstrates that evolution can crystallize them into durable rules.
WHY IT MATTERS
Zombie Agents gives security researchers a concrete framework to reason about memory evolution as an attack surface, not just a capability feature.
Builders can now design agents that treat long term memory as part of the trusted computing base, adding provenance, policy checks, and separation of data and instructions during FM writes and retrievals.
Xingyu Lyu, Jianfeng He et al.
· 2026
ADAM combines Anchor extraction, Distribution estimation, Anchor selection, and Query generation to adaptively probe agent memory via an auxiliary generator and entropy based selection. On the EHRAgent benchmark with Llama2-7b-chat, ADAM reaches EQ=77 and ASR=1.00, compared to MEXTRA’s EQ=44 and ASR=0.89.
Okan Bursa
· 2026
Adaptive RAG Memory (ARM) augments a standard retriever–generator stack with a Dynamic Embedding Layer and Remembrance Engine that track usage statistics and apply selective remembrance and decay to embeddings. On a lightweight retrieval benchmark, ARM achieves NDCG@5 ≈ 0.9401 and Recall@5 = 1.000 with 22M parameters, matching larger baselines like gte-small while providing the best efficiency among ultra-efficient models.
Yijie Zhong, Yunfan Gao, Haofen Wang
· 2026
HingeMem combines Boundary Guided Long-Term Memory, Dialogue Boundary Extraction, Memory Construction, Query Adaptive Retrieval, Hyperedge Rerank, and Adaptive Stop to segment dialogues into element-indexed hyperedges and plan query-specific retrieval. On LOCOMO, HingeMem achieves 63.9 overall F1 and 75.1 LLM-as-a-Judge score, surpassing the best baseline Zep (56.9 F1) by 7.0 F1 without using category-specific QA formats.
Answers use this explainer on Memory Papers.
Checking…