Research

Paper

AI LLM March 16, 2026

From Storage to Steering: Memory Control Flow Attacks on LLM Agents

Authors

Zhenlin Xu, Xiaogang Zhu, Yu Yao, Minhui Xue, Yiliao Song

Abstract

Modern agentic systems allow Large Language Model (LLM) agents to tackle complex tasks through extensive tool usage, forming structured control flows of tool selection and execution. Existing security analyses often treat these control flows as ephemeral, one-off sessions, overlooking the persistent influence of memory. This paper identifies a new threat from Memory Control Flow Attacks (MCFA) that memory retrieval can dominate the control flow, forcing unintended tool usage even against explicit user instructions and inducing persistent behavioral deviations across tasks. To understand the impact of this vulnerability, we further design MEMFLOW, an automated evaluation framework that systematically identifies and quantifies MCFA across heterogeneous tasks and long interaction horizons. To evaluate MEMFLOW, we attack state-of-the-art LLMs, including GPT-5 mini, Claude Sonnet 4.5 and Gemini 2.5 Flash on real-world tools from two major LLM agent development frameworks, LangChain and LlamaIndex. The results show that in general over 90% trials are vulnerable to MCFA even under strict safety constraints, highlighting critical security risks that demand immediate attention.

Metadata

arXiv ID: 2603.15125
Provider: ARXIV
Primary Category: cs.CR
Published: 2026-03-16
Fetched: 2026-03-17 06:02

Related papers

Raw Data (Debug)
{
  "raw_xml": "<entry>\n    <id>http://arxiv.org/abs/2603.15125v1</id>\n    <title>From Storage to Steering: Memory Control Flow Attacks on LLM Agents</title>\n    <updated>2026-03-16T11:21:30Z</updated>\n    <link href='https://arxiv.org/abs/2603.15125v1' rel='alternate' type='text/html'/>\n    <link href='https://arxiv.org/pdf/2603.15125v1' rel='related' title='pdf' type='application/pdf'/>\n    <summary>Modern agentic systems allow Large Language Model (LLM) agents to tackle complex tasks through extensive tool usage, forming structured control flows of tool selection and execution. Existing security analyses often treat these control flows as ephemeral, one-off sessions, overlooking the persistent influence of memory. This paper identifies a new threat from Memory Control Flow Attacks (MCFA) that memory retrieval can dominate the control flow, forcing unintended tool usage even against explicit user instructions and inducing persistent behavioral deviations across tasks. To understand the impact of this vulnerability, we further design MEMFLOW, an automated evaluation framework that systematically identifies and quantifies MCFA across heterogeneous tasks and long interaction horizons. To evaluate MEMFLOW, we attack state-of-the-art LLMs, including GPT-5 mini, Claude Sonnet 4.5 and Gemini 2.5 Flash on real-world tools from two major LLM agent development frameworks, LangChain and LlamaIndex. The results show that in general over 90% trials are vulnerable to MCFA even under strict safety constraints, highlighting critical security risks that demand immediate attention.</summary>\n    <category scheme='http://arxiv.org/schemas/atom' term='cs.CR'/>\n    <published>2026-03-16T11:21:30Z</published>\n    <arxiv:primary_category term='cs.CR'/>\n    <author>\n      <name>Zhenlin Xu</name>\n    </author>\n    <author>\n      <name>Xiaogang Zhu</name>\n    </author>\n    <author>\n      <name>Yu Yao</name>\n    </author>\n    <author>\n      <name>Minhui Xue</name>\n    </author>\n    <author>\n      <name>Yiliao Song</name>\n    </author>\n  </entry>"
}