Sharing our recent work on agentic system security—happy to discuss and collaborate! Traditionally, Prompt Injection was seen as a one-off attack in a single interaction or context. But in agentic systems, models aren’t stateless assistants anymore—they have memory, filesystems, tools, long-term tasks, and cross-session state. This fundamentally expands the attack surface. In our paper, we systematically revisit Prompt Injection from a system security perspective and introduce a new attack vector: Cross-Session Stored Prompt Injection. Inspired by stored XSS in web security, malicious prompts can persist across sessions and be re-triggered. This extends attacks across time (surviving across sessions) and space (via memory, files, tool outputs, retrieved artifacts, etc.), turning a short-lived model-level threat into a long-lived system-level vulnerability embedded in the agent’s execution state. We formalize stored prompt injection, propose a taxonomy, and provide benchmarks & a sandbox toolkit for evaluating different models, targets, and persistence channels. Paper: arxiv.org/abs/2606.04425

The open-source LLM uncensoring tool heretic just hit GitHub Daily Trending #1, which can "crack" Gemma 4 in 90 mins. We tested our last year's work [1] against it and found something surprising: our method shows strong resilience against heretic. Attackers can hardly strip the model's intrinsic safety mechanisms without catastrophic performance loss. A new angle for open-source LLM safety governance? [1] Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction, EMNLP 2025