CarryoverBench: a planted order fires again after the attacker leaves
A one-time injection planted in an agent's memory or schedule keeps firing in later sessions, the CarryoverBench authors report.
· arXiv · Research by Zhiyue Xu, Xukai Wang, Zhiyuan Huang, Mingjie Zhan, Jian Zhao, Xu-Yao Zhang
CarryoverBench measures prompt injections that survive the session where they were planted and re-fire through an agent's scheduled heartbeat or long-term memory. The authors report no decay over five later rounds.
01What happened
CarryoverBench reached arXiv on October 20, 2026, from Zhiyue Xu and five co-authors, with code on GitHub and a note that the paper is accepted to the EMNLP 2026 main conference. The benchmark holds 12 personal-assistant scenarios and 101 attack tasks. Existing injection benchmarks test only the session in which malicious content first appears, which is the gap the authors set out to close.
02How it works
Carryover uses two kinds of agent state: long-lived memory files that get appended to the system prompt, and scheduled tasks that wake the agent with no user present. The benchmark separates three trigger channels, named Instant, Autonomous and Latent, and scores planting and triggering as two stages with a rule-based verifier. In the published repository the Autonomous channel writes to HEARTBEAT.md and the Latent channel to MEMORY.md.
03Who is affected
Five frontier models were measured and the spread is wide, from 11.9% overall attack success on GPT-5.4 to 63.4% on Qwen3-235B-A22B, with the per-model figures below. Plant rates drive most of that difference, because a planted payload usually fires once it is in place. Agents that keep memory files or run scheduled tasks are the exposed configuration.
04What to do
Treat agent memory files and scheduled-task files as untrusted input that needs review before it reaches the system prompt. The authors ported the Latent channel to the Hermes runtime and saw success rates fall without reaching zero, which they read as evidence that prompt-level defenses need runtime controls alongside them.
Measured results
Overall attack success rate, CarryoverBench
Higher is worse for defenders
| Result | Score |
|---|---|
| GPT-5.4 | 11.9% |
| Claude-Sonnet-4.6 | 18.8% |
| Gemini-3.1-Pro | 51.5% |
| GLM-5 | 27.7% |
| Qwen3-235B-A22B | 63.4% |
Scale 0 to 100% · Source: arxiv.org, as published
Questions people ask
- Which model resisted carryover attacks best in CarryoverBench?
- GPT-5.4 scored lowest in the benchmark at 11.9% overall attack success, followed by Claude-Sonnet-4.6 at 18.8%, GLM-5 at 27.7%, Gemini-3.1-Pro at 51.5% and Qwen3-235B-A22B at 63.4%. The authors attribute most of the gap to the planting stage, because once a payload is planted the trigger stage adds little protection.
- Does a carryover payload weaken over later sessions?
- Trigger rates showed no monotonic decay across five follow-up rounds, the CarryoverBench authors report. Autonomous trigger rates for Qwen3 stayed around 70 to 77%, and Latent rates for Gemini held near 31 to 36% after the first round. GLM-5 was the exception, with a lower trigger rate than the other four models.
- Does switching the agent runtime stop a carryover injection?
- Switching runtime reduced the effect without removing it. The authors re-ran the 36 Latent variants on Hermes, an open-source agent runtime from Nous Research, using the same models and the same verifier. Attack success fell for every model, with Qwen3 dropping from 52.8% to 27.8%, yet no model was fully protected.
Sources 2 links, all fetched
- 1arxiv.orgarXiv Paper
- 2github.comCarryoverBench Code