Research · curated 8 Sep 2026
InjecMEM: Memory Injection Attack on LLM Agent Memory Systems
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
InjecMEM demonstrates that persistent memory subsystems now default in deployed LLM agents can be poisoned by a single benign-looking interaction to hijack future responses, expanding the agent attack surface for personalization-driven assistants in healthcare, finance, and other domains.
InjecMEM is a memory injection attack paradigm from researchers at Shanghai Jiao Tong University and Ant Group that requires only a single interaction (no read/edit access to the memory store) to steer later responses of related queries toward a pre-specified output in LLM agent memory systems. The attack crafts a retriever-agnostic anchor with high-recall topical cues plus a gradient-optimized adversarial command, achieving reliable topic-conditioned retrieval and targeted generation across multiple memory systems and backbone models while leaving non-target queries unaffected. Code is published at the authors' GitHub repository.