An agent may summarize retrieved material into a memory store to make later tasks easier. The Role Grounding Attack places apparently personal statements inside quoted or third-party dialogue and tests whether the agent mistakes that source identity for the current user. The prompt-injection effect is delayed: the memory entry can shape future decisions…
Inspect the ClaimsCase · DiggingBeagle record
Quoted third-party dialogue became a false user preference in agent memory tests
A Role Grounding Attack study tested whether agents promote dialogue found in lower-trust material into the active user’s enduring preferences.
Scope
Laboratory manipulation of memory selection from quoted text; exact impact across production memory systems and later real user choices remains unknown.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The cited controlled research demonstrates identity confusion but not a field compromise of any named commercial memory feature. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-ROLE-GROUNDING-MEMORY-1 · Role Grounding Attack: quoted dialogue contaminating agent preference memory
At a glance
The flaw is delayed memory attribution, not necessarily a single-turn instruction-policy bypass.
Read the implicationsPersistent production memory corruption and user harm are not demonstrated. The effectiveness of provenance checks in different products requires independent testing.
Limits and uncertaintyFull account
An agent may summarize retrieved material into a memory store to make later tasks easier. The Role Grounding Attack places apparently personal statements inside quoted or third-party dialogue and tests whether the agent mistakes that source identity for the current user. The prompt-injection effect is delayed: the memory entry can shape future decisions even after the original malicious text is no longer visible. That is a different boundary from an attacker directly asking an assistant to disobey an instruction in one turn.
The result is a controlled study of memory attribution and should not be represented as a verified compromise of a specific commercial memory system. The key test is whether the memory store records the speaker, source, time and approval for a claimed preference. If source text is allowed to create a user-owned preference without confirmation, provenance has become an executable instruction channel.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 29, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-ROLE-GROUNDING-MEMORY-1The Role Grounding Attack study documents conditions in which quoted external dialogue is elevated into an agent’s representation of a user preference.supported
Basis: reported finding
- supportsRole Grounding Attack: quoted dialogue contaminating agent preference memoryprimary disclosure
arXiv:2610.38209, attack formulation and memory update evaluation
Implications
The flaw is delayed memory attribution, not necessarily a single-turn instruction-policy bypass.
Controls and mitigations
- Store speaker, origin and approval with each memory; prohibit third-party quotes from becoming user preferences without explicit confirmation.
Unknowns and contradictions
- Persistent production memory corruption and user harm are not demonstrated.
- The effectiveness of provenance checks in different products requires independent testing.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208