Carryover isolates the planting and later activation of persistent agent injection

CLM-CARRYOVER reports: Carryover evaluates persistent injection across 101 tasks and 12 scenarios, separating the turn that plants malicious state from later turns that trigger it. Source SRC-2026-RADAR-CARRYOVER is located at 'Abstract, benchmark design and persistence analysis'. The distinctive mechanism begins: CarryoverBench separates an attacker's initial insertion into persistent memory or a scheduled heartbeat task from the later activation of that content. Classification: setting=evaluation, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=not_applicable; scoped control or limit: Treat persisted instructions as untrusted, revalidate the author and intended permissions on each reload, and gate autonomous scheduled effects independently from the text that requested them. A later agent turn must not inherit irrevocable authority merely because a file survived. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.

Assessed Oct 23, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-CARRYOVER · Carryover preprint, arXiv 2610.28425v1