Research on AI Agent Memory Poisoning Attack 'Self-State Attack'

According to a recent study published on arXiv, a new threat model called the 'Self-State Attack' has been defined, which targets the self memory and configuration files (State files) that AI agents read and write in order to perform their functions.

This attack induces the agent to modify its own state through normal OS system calls, and the researchers formalized it into a 23-cell matrix based on four axes (target, mechanism, granularity, and temporal characteristics).

Key Findings:

• Limits of defense systems: Even when a layered defense stack—including access control, workload-based detection, and periodic backups—is applied, certain attack types remain difficult to detect.
• Structural undetectability: In particular, memory-row writes attacks occurring within operations-style workload profiles showed a structural limitation in which normal behavior and malicious edits cannot be distinguished at the kernel level.
• Implications: Since there is a structural ceiling to OS-level defenses, an engineering approach at a higher level of the stack (Application/Agent level) is needed to secure agents.