{"_canonicalization":{"envelope_id":"axm_ + sha256(envelope minus {signature, axiom_id, anchors})","envelope_signature":"ed25519(envelope minus {signature, axiom_id})","json":"sort_keys=True, separators=(',',':'), ensure_ascii=False, allow_nan=False, utf-8","leaf_hash":"sha256(0x00 || canonical_json(envelope_full))","seal_signature":"ed25519(seal minus {signature, sig_algorithm})"},"axiom_id":"axm_b3ca24ebe53635b2feeeff0ce26bcc3cc145f9542977be2791c6aae286263714","bitcoin_anchor":{"bitcoin_attestations":[],"calendar_attestations":[],"ots_url":"","stamped_at":"","status":"pending_next_stamp"},"envelope":{"anchors":[{"chain":"crovia.axiom_graph","height":0,"merkle_proof":"spider_vendor_press_v1","root_at_anchor":"spider_vendor_press_v1"}],"axiom_id":"axm_b3ca24ebe53635b2feeeff0ce26bcc3cc145f9542977be2791c6aae286263714","axiom_type":"AX.OBS","body":{"axiom_subtype":"news.vendor_press.v1","category":"news","fingerprint":"f55aa92b9e1985229cc408182c9f2b27a19185f836f731bd285935ee23f5640e","published":"Fri, 17 Jul 2026 00:00:00 -0400","receipt_hash":"f55aa92b9e1985229cc408182c9f2b27a19185f836f731bd285935ee23f5640e","schema":"spider.news.vendor_press.v1","spider":"vendor_press","spider_record":{"axiom_subtype":"news.vendor_press.v1","category":"news","decision_hint":"POSITIVE","envelope_target":"AX.OBS","fingerprint":"f55aa92b9e1985229cc408182c9f2b27a19185f836f731bd285935ee23f5640e","observed_at":"2026-07-17T04:43:38.280949Z","parent_run_hash":"113193614a8af99887180226d4e28a8b71d957da5fe3694f0e7a56807c145504","published":"Fri, 17 Jul 2026 00:00:00 -0400","runtime_version":"0.1.0","schema":"spider.news.vendor_press.v1","source_status":200,"source_url":"https://export.arxiv.org/rss/cs.AI","spider":"vendor_press","summary_excerpt":"arXiv:2607.14611v1 Announce Type: cross \nAbstract: A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases. While this makes agents more useful and self-improving, it also creates a new attack surface for prompt injections in which malicious instructions can be embedded within persistent files and influence future behavior. In this work, we study prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace. We evaluate two agentic systems, Anthropic Claude Code and OpenAI Codex, across four models: Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. Our results show that although it is difficult to make an agent overwrite its own memory files using untrusted external content, payloads already planted in those files can successfully attack current and future sessions. Attack success and payload persistence vary substantially across systems, models, adversarial go","title":"Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems","url":"https://arxiv.org/abs/2607.14611","vendor":"arxiv_cs_ai"},"summary":"arXiv:2607.14611v1 Announce Type: cross \nAbstract: A growing class of agentic systems maintain persistent state across sessions through memory files, behavioral preferences, and knowledge bases. While this makes agents more useful and self-improving, it also creates a new attack surface for prompt injections in which malicious instructions can be embedded within persistent files and influence future behavior. In this work, we study prompt injection attacks in memory-based agentic systems using a sandboxed synthetic workspace. We evaluate two agentic systems, Anthropic Claude Code and OpenAI Codex, across four models: Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. Our results show that although it is difficult to make an agent overwrite its own memory files using untrusted external content, payloads already planted in those files can successfully attack current and future sessions. Attack success and payload persistence vary substantially across systems, models, adversarial go","title":"Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems","vendor":"arxiv_cs_ai"},"confidence":{"method":"deterministic"},"decision":"POSITIVE","issued_at":"2026-07-17T04:43:38Z","notes":"Spider vendor_press (news) news.vendor_press.v1","object":{"captured_by":"crovia.spider.vendor_press","primary_source_url":"https://arxiv.org/abs/2607.14611"},"predecessors":[],"schema":"crovia.axiom.v1","signature":"ed25519:3197ee8038986414ab18594e93b65d8d8720db3c62afbbc3a0ae6f3e81d5bb54fd33946c1c54194e9ea90fd67778355ed35050d7a6dd61b40192caa95f40060e","signer":"crovia.substrate","subject":{"observed_at":"2026-07-17T04:43:38Z","source_collector":"spider:vendor_press","target_id":"https://arxiv.org/abs/2607.14611"},"tsa":{"authority":"crovia.substrate.bootstrap","rfc3161_token":"{\"kind\":\"crovia.bootstrap.tsa\",\"source_jsonl\":\"/opt/crovia/spider/data/news/vendor_press_v1.jsonl\",\"source_seal_merkle_root\":\"spider_vendor_press_v1\",\"upgrade_path\":\"Sessione H \\u2014 OpenTimestamps weekly anchor\"}"},"zk_mode":"clear","zk_proof":null},"ledger":{"leaf_hash":"35beab4c4e6f54694d52cd529f246160f2a30a858a9be4461ba820f982d87d05","leaf_index":323126,"ledger_path":"/opt/crovia/substrate/axiom_ledger.jsonl"},"merkle_proof":{"hash_alg":"sha256","leaf_prefix":"0x00","node_prefix":"0x01","odd_leaf_rule":"duplicate_last","path":[{"sibling":"d0e38f0dc805838da412b886aa92efa8b7c672851ed132b36f06392f3f0f0c37","side":"right"},{"sibling":"59faa24abb2cd982e89e8db42f661bf3ffdfefa68028c0f7474cf664e6beb796","side":"left"},{"sibling":"48ec89408aedccd92536fc6ff9701d8355d6e84200ddd7f2877c84575e35b6ce","side":"left"},{"sibling":"765d92b040f3f608057692e40da92945aff32b86496f5b1abe3f9ab082f37590","side":"right"},{"sibling":"1f2cd1918f8ac2563ef33a2da3a99817644034f9616a9f020065dc5c666cf191","side":"left"},{"sibling":"86ed41f2483d0f15afaf14a254cf1f1f4f99b34c1507bbc0f1be3b355c369b6d","side":"left"},{"sibling":"5ff315166458d1adbaa358c18de4128f9e9bbf19a8a9158ad86b1f0230dee929","side":"right"},{"sibling":"de6ef12c0ebc7e3e48430c64265163103eb92448efd698dbc2b104ada5a5389d","side":"right"},{"sibling":"4242cc570ec8c36a37f3f6f20dcae20b49fccc17c7b53ba47d8715e465bec585","side":"right"},{"sibling":"be025f48721bfc0ca7107f0454bda3ab460e50539f0caeb1bf839a8dabcf036c","side":"left"},{"sibling":"05a09763743cdc09fc45cf454e4e3ea4a0d1cd74f9c8162b2a57e2c873160908","side":"left"},{"sibling":"de3120ef2488b8a791a686b47257da4e612256abdfcdda7519265e7edd47d041","side":"left"},{"sibling":"e86f56a4883492da5b5e7b0201324c52946e865e69b99ebb532f41fe3c658ee4","side":"right"},{"sibling":"34d85f6ad6cc7dfa79d90e2b9ff99a561bcdc75b0301bbbd3e83861f54535c1e","side":"left"},{"sibling":"f302542c38ba7c3aab7c9280dd60259ecec777dca6e6f71b6f0729b0b8791b72","side":"left"},{"sibling":"d8b9143917b539c543cf4448cec00131f8b807bd8004979c54ebe09798748c66","side":"left"},{"sibling":"9b11714124b9b951ff9450b0ee9d625a0b70b6da2cf388bd3df1475eec0b17ba","side":"right"},{"sibling":"a4523a9014d45df43e006e9210a73428c380d771f2c650a1b986910759b0cdf7","side":"right"},{"sibling":"1cecb7f447febd025aac272837c80de218aecc6485d2395a509b2a1f1b9c746e","side":"left"}]},"schema":"crovia.axiom_proof.v1","seal":{"first_collector_run_id":"","first_receipt_hash":"","jsonl_path":"/opt/crovia/substrate/axiom_ledger.jsonl","key_id":"430895f101d38164","last_collector_run_id":"","last_receipt_hash":"","leaf_count":323382,"merkle_root":"2f4d32419c80a9600aba5a480fc3fb7012ec0a695c91a1b055048e78760b65ca","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","run_id":"hourly_json_retrofit_20260717T053701Z","schema":"crovia.seal.v1","seal_family_version":"crovia-seal-family/1","seal_kind":"substrate_batch","sealed_at":"2026-07-17T05:38:31Z","sig_algorithm":"ed25519","signature":"495308c7bf004117807331d3f71d0b079f6bd7ed7737faa58c773b1b3e80ee84928d2d8519cc7d2b809506501aada1be6546f72c7ecda3dad5445cbb44502209","signer_version":"1.1.0"},"trust_root":{"key_id":"430895f101d38164","public_key_hex":"cf742e26f75669dc673cb5c0786a1ae23ae8ca19c347317192ce40c28a7ff25c","signature_algorithm":"ed25519","url":"/registry/canon/TRUST_ROOT.md"},"verifier":{"spec":"/registry/canon/AXIOM_RECEIPT_v1.md","url":"/v/axm_b3ca24ebe53635b2feeeff0ce26bcc3cc145f9542977be2791c6aae286263714"}}