How an instruction survives after its original message loses authority

A malicious instruction can remain effective after its original webpage, tool response or conversation has disappeared from view. The persistence itself is not the whole attack. A later system must retrieve or summarize the content, treat it as sufficiently authoritative, and then use a tool or disclose information because of it. Recent experiments make those transitions separately measurable.

CarryoverBench begins with planting: an attacker influences persistent files, memory or a scheduled heartbeat so the instruction will appear again. It then measures activation during a later task. The researchers' 101 attacks across twelve scenarios include immediate, autonomous and latent channels. Their finding of persistence across five follow-up rounds is conditional on successful planting and the study's scripted environment; it does not mean any random attack survives five production sessions.

Compaction Laundering studies a different transition. A forged approval enters through a tool response, then a summarizer flattens role-labeled exchanges into ordinary text. At the tested component boundary, five role-flattening harnesses laundered 13 to 15 of 15 trials, while four role-typed implementations laundered none. The experiment did not mean those nine complete products all made unauthorized payments: the authors evaluated captured serialization and summarization paths, then examined downstream execution in smaller, separate tests.

Both mechanisms are forms of context privilege escalation, but the protections attach at different points. A memory write needs durable provenance and revocation; a summary needs authenticated role origin rather than a bare assertion that "the user approved." A role-typed serializer is not an automatic cure for a malicious instruction already authorized by some other path.

The long-term memory study distinguishes attacks against one user's future sessions from propagation through organization-wide memory. In its Claude organizational scenario, the owner had to configure the shared skill or connector; that privilege requirement matters. The reported spreadsheet logging behavior cannot be attributed to an arbitrary external webpage with no owner-level access. These experiments show plausible propagation mechanisms, not a demonstrated production breach affecting all users of a memory feature.

AutoRedClaw tests state reload across seven agent harnesses using a separate 330-case benchmark. Its success and trigger metrics depend on harness, model and attack setup. They cannot be averaged with Carryover's planting rate or Compaction Laundering's component-level summary metric. The useful comparison is structural: all expose the danger of treating where a string is stored now as proof of who was allowed to issue it originally.

The Copilot hidden-comment investigation places instructions in Markdown that the agent reads but the assigning user may not see in rendered form. This attack need not persist for days. The relevant promotion occurs when issue data influences privileged agent tools, and subsequent CI or cloud escalation requires separate permissions. The same provenance question appears at the entry boundary rather than only after a memory write.

An end-to-end test should preserve four observations: the untrusted origin; the stored or summarized representation; the later authority decision; and the exact side effect, if any. The studies support that layered measurement. Counting every planted entry as a completed compromise would not.