Self-State Attacks: New Threat Poisons AI Agents via Their Own Memory
New research defines 'self-state attacks'—AI agents compromised via their own memory files—and finds OS-level defenses hit a structural limit.
A new paper formalizes 'self-state attacks,' a threat class where self-hosted AI agents are compromised through corruption of their own memory or configuration files using legitimate OS system calls, distinct from prompt injection.
The authors map the attack surface across four axes—Target, Mechanism, Granularity, and Temporal—producing a 23-cell matrix of 43 concrete file operations, then inject these into live activity traces from a representative self-hosted agent across multiple workload profiles. They test a layered defense combining access-control prevention, workload-conditioned detection, and periodic backup.
The key finding for engineers: under the recommended defense, 11 attack cells become visible and 8 conditionally detectable, but 4 remain structurally indistinguishable from normal behavior at the OS level—concentrated on memory-file writes during operations-style workloads. Experiments ran on the authors' own lightweight research harness rather than production agent runtimes, so exact numbers may not transfer directly. Still, the result suggests defenses need to move up the stack toward application-layer integrity checks, canary entries, and signed agent state, rather than relying solely on filesystem permissions.