{
  "schema_version": 1,
  "builder_plan": {
    "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.",
    "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.",
    "baseline": "Your existing checks with the same tasks, permissions, and tool responses.",
    "steps": [
      "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.",
      "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.",
      "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.",
      "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test."
    ],
    "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.",
    "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation."
  },
  "builder_review": null,
  "arxiv_id": "2610.28425",
  "title": "After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents",
  "summary": "This is an evaluation benchmark, not a deployable technique; it replaces single-session prompt-injection testing with multi-round measurement of memory-resident and scheduled-task payload re-firing. Running its 101 tasks against your agent costs API calls and engineering time, and the actionable finding is that defenses must sit at the runtime layer (memory-write gating, scheduled-task review) rather than in prompts. It can fail to transfer if your agent lacks persistent memory or heartbeat scheduling, and results on five frontier models may not predict behavior of the specific model and runtime you deploy.",
  "rationale": "The reader operates LLM agents in production and should validate whether their own runtime permits persistent-state carryover before relying on prompt-level injection defenses.",
  "technique": "Carryover attack benchmark for stateful LLM agents",
  "family": "seguranca_e_guardrails",
  "recommendation": "testar",
  "published": "2026-10-20",
  "as_of": "2026-10-21",
  "editorial_status": "indexed",
  "source_url": "https://arxiv.org/abs/2610.28425",
  "independent_implementations": 4,
  "total_implementations": 4,
  "stars": 156,
  "citations": null,
  "claims": [
    {
      "claim_id": "claim-01",
      "statement": "This is an evaluation benchmark, not a deployable technique; it replaces single-session prompt-injection testing with multi-round measurement of memory-resident and scheduled-task payload re-firing. Running its 101 tasks against your agent costs API calls and engineering time, and the actionable finding is that defenses must sit at the runtime layer (memory-write gating, scheduled-task review) rather than in prompts. It can fail to transfer if your agent lacks persistent memory or heartbeat scheduling, and results on five frontier models may not predict behavior of the specific model and runtime you deploy.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.28425",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "claim_id": "claim-02",
      "statement": "No efficiency claim; empirical finding: planted payloads re-fire without measurable decay over five rounds across five frontier models, and trigger-stage gating often adds little protection once planting succeeds.",
      "basis": "inferred",
      "result": "",
      "baseline": "",
      "conditions": "",
      "source_url": "https://arxiv.org/abs/2610.28425",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "exposure_map": [
    {
      "dimension": "quality",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compute",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "latency",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "operations",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "compatibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "security",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "data_and_training",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    },
    {
      "dimension": "reproducibility",
      "basis": "not_evaluated",
      "finding": "",
      "interpretation": "",
      "limitation": "",
      "next_check": "",
      "source_url": "",
      "source_page": null,
      "source_excerpt": ""
    }
  ],
  "risks": [],
  "minimum_test": [],
  "open_questions": [],
  "independent_tests": [],
  "lab_reproductions": [],
  "report_available": false,
  "validation_tier": "unknown",
  "evidence_tier": "unknown",
  "infrastructure_basis": "unknown",
  "equations": [],
  "equations_status": "not_fetched",
  "core_kind": "",
  "equations_fetched_at": "",
  "equations_source_url": "",
  "equations_source_sha256": "",
  "exposures_reviewed_at": "",
  "exposures_source_sha256": ""
}