A new arxiv paper by Yimeng Chen et al. formalizes 'self-state attacks' against AI agents, where an agent's own memory and configuration files are poisoned via legitimate OS calls. The authors evaluate OS-level defenses and identify structural limitations, suggesting the need for application-layer integrity measures.
There is a specific kind of AI security problem that has been sitting in plain sight while everyone argued about prompt injection: what happens when the agent's own state files are the thing that gets poisoned. A [new paper on arxiv](https://arxiv.org/abs/2607.17986) by Yimeng Chen, Nathanaël Denis, Roberto Di Pietro and Jürgen Schmidhuber gives that failure mode a name, self-state attacks, and asks how far operating system defenses can actually take you against it. The setup is direct. Self-hosted AI agents read and write their own memory and configuration files to function, and the authors' claim is that an agent may get compromised via corruption of its own state, a compromise realized via legitimate OS system call invocation. They formalize the space along four axes, Target (instruction, memory, or configuration), Mechanism (modify, add, delete, deny), Granularity (whole-file down to minimal edits), and Temporal (single-shot through slow-drip), then turn that space into a 23-cell matrix with 43 concrete operations on real self-state files, injected into live activity traces from a representative self-hosted agent running across distinct workload profiles. The empirical result is where the paper earns attention. A layered defense stack, described as access-control prevention on the instruction and configuration layers, workload-conditioned detection on the memory layer, and periodic backup for recovery, handles most of the matrix. Under the authors' recommended configuration, 11 attack cells become visible, 8 become conditionally detectable, and 4 remain what they call structurally indistinguishable at the OS level. Those four concentrate on memory-row writes inside operations-style workload profiles, meaning normal agent behavior and the malicious edit look the same to the kernel. The forward-looking read is what makes this worth watching. If OS-level defense really does have a structural ceiling for agent state, the useful engineering moves up the stack, toward application-layer integrity checks on memory files, canary entries, and signing of the agent's own state. Vendors shipping managed agent runtimes get a cleaner story here than teams telling customers to lock down filesystem permissions and hope. https://aiweekly.co/alerts/schmidhuber-et-al-formalize-self-state-attacks-on-ai-agents
This paper investigates OS resilience against self-state attacks on self-hosted AI agents, characterizing an attack space and evaluating layered defense strategies. It finds that while a layered defense stack is effective, a small residual attack surface remains structurally indistinguishable at the OS level.
This paper introduces GhostWriter, a novel attack vector that exploits memory subsystems in LLM-powered personal agents to poison their memory store, achieving high injection and activation rates. The authors propose AM-Sentry, a defense that significantly reduces attack success while maintaining agent utility.
This paper identifies a structural failure in multi-agent AI pipelines where memory-layer attacks can be misattributed as model misalignment, formalizing Semantic Norm Drift (SND) and proposing Counterfactual Composition Testing and Memory-Persistent Information-Flow Control as defenses.
Attackers can hijack AI agents by injecting malicious content into retrieved sources, exploiting the inability to distinguish instructions from content, as identified in OWASP's top 10 for agentic applications.
A discussion of how data poisoning and RAG manipulation pose a silent, dangerous threat to AI systems, arguing that security must extend beyond input filtering to memory, data pipelines, and multi-agent logic.