Three ways an agent's past changes its next action: memory, skills and code

An agent can finish a legitimate task and still leave behind something it should never trust again. In one study, a manipulated tool result was saved as memory. In another, poisoned reference answers taught an optimizer to write an enduring Skill. In a third, a previously approved tool kept its familiar interface while its executable code changed. Their effects can look similar in a final agent transcript, but their entry points and remedies are not interchangeable.

These are controlled research systems, not a confirmed linked intrusion campaign. Comparing them is useful precisely because each experiment removes a different assumption about what remains trustworthy between the point of approval and the point of action.

These paths are not interchangeable. MemoryDojo does not require direct write access to the memory store. Skill poisoning does not require a malicious user prompt during the target task. ETUDE does not require the agent to obey any malicious instruction at all: the unsafe action can happen inside implementation code when a completely ordinary call is made.

MemoryDojo ran 155 trajectories and 2,162 legitimate task sessions across five memory implementations. In one same-domain metric, optimized attacks against Mem0 raised later-task reach from 7.90% to 21.02%. Those numbers measure selected future tasks, not compromise across all Mem0 users. The paper also reports an any-success-over-trajectory metric, which answers a different question and must retain its own denominator.

The skill-optimization study poisoned 30% of 400 reference examples. A generated Skill emitted an attacker-selected output in 200 of 200 triggered SearchQA tests. Crucially, a different workbook objective succeeded zero times in 120 natural optimization trials. The first outcome proves that a learned instruction persisted in the tested response pattern. It does not prove the same persistence granted arbitrary filesystem effects.

ETUDE reports 97.6% attacker-goal success and 95.9% legitimate task completion in its seven-framework controlled setup. This result is conditioned on the attacker already controlling the executable tool update channel. No inference is warranted that an attacker can obtain that authority by sending one webpage or chat message.

The experiments therefore have distinct units of observation: successful later-task steering, learned output behavior, and execution of a modified implementation. Placing their percentages side by side as competing general-purpose 'agent compromise rates' would be misleading.

For memory, retain the identity and access context of the tool response that generated each saved fact. A later user request should not grant an old untrusted source the right to issue new instructions. The difficult case is derived memory: a poisoned instruction may be summarized, linked or recalled after the original message is deleted.

For generated Skills, the approval checkpoint belongs before reference material becomes a reusable instruction. Independent test cases should ask both whether the Skill helps complete legitimate work and whether it violates write, disclosure or network permissions. A high clean-task completion score cannot establish either property on its own.

For executable tools, provenance should be checked again when the implementation changes, not only when the name and JSON schema were first accepted. The host must still enforce the permitted effects of each call because a signed or pinned artifact can be faithfully identified and nonetheless contain unsafe behavior.

These checks can be layered, but none can replace the others. A perfectly attributed memory says little about an unauthorized tool binary. A hashed binary says little about whether an agent inferred a new instruction from a stored document. A correct final answer says little about which side effects occurred while creating it.

A useful shared test harness would preserve the same legitimate job, then separately change one lower-trust tool response, one optimizer reference answer or one tool executable. For each branch, record the object changed, its authorization context, the resulting agent call, and the actual external effect. This produces a causal trace instead of treating every case as a text-level jailbreak.

The underlying MemoryDojo source, Skill feedback paper and ETUDE study support the three mechanisms. The proposed unified harness is editorial analysis, not an experiment those authors already ran.