'Zombie Agents': a single injection can permanently hijack a self-evolving AI agent

A self-evolving LLM agent can be permanently hijacked by a single indirect injection. The "Zombie Agents" paper, released in February 2026, shows that a malicious instruction an attacker plants in web content gets written into the agent's long-term memory, then revives across sessions to trigger unauthorized tool calls. ASAP summarizes the paper from the original.

Two stages: infection and trigger

The attack hijacks a self-evolving LLM agent in two stages, infection and trigger. During infection, the attacker plants a malicious payload in web content the agent meets during normal tasks, and the payload is written into long-term memory through the standard update process. During trigger, the stored payload is retrieved and activates unauthorized tool behavior. It is a black-box attack that needs no access to model internals.

Why "permanent" is not an overstatement

The attack stays persistent because sliding-window and RAG memory keep the payload alive across sessions. The authors designed mechanism-specific persistence strategies for common memory types, including sliding-window and retrieval-augmented memory, and these strategies resist truncation and relevance filtering. The paper states that memory evolution can convert a one-time indirect injection into persistent compromise.

The striking part is that the "self-evolving" design intent becomes the weakness itself. The very structure that lets an agent update its own memory to grow smarter also hands the attacker a channel that re-infects on its own after they walk away. Even if a defender wipes the payload once, the memory-update loop revives it in the next session, so an ordinary session close or context reset is not a fix.

Per-session filtering does not stop it

Per-session prompt filtering is not enough to stop this attack on self-evolving LLM agents. In the threat model, untrusted external content met during a benign session is stored as retrievable memory and later reused as instructions. So a defense limited to per-session input checks is not sufficient for self-evolving agents.

What practitioners should take away

Long-term memory is itself an attack surface for any RAG-based agent. The more memory an agent carries to act smarter, the more places a malicious instruction can persist. Defense has to move past the input stage into the memory write and retrieval stages.

For teams rushing to ship RAG agents wired to internal documents and web search, this paper is not someone else's problem. Any design that reads external content and accumulates the result in memory inherits the same threat model. In practice you need a write gate that decides what gets stored as memory, plus isolation at the retrieval stage that treats stored content as reference material rather than as instructions.

Open questions and limits

That said, this is a paper showing the attack is possible, not one that reports how often it occurs in production or offers a complete defense. Whether the same result holds outside the memory types and threat-model assumptions it tested, and how much sanitizing the memory-write stage blunts persistence, are matters for follow-up work beyond this summary. One conclusion is firm: the more memory an agent has, the deeper the defense line must move.

Source: ASAP summary of "Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections" (arXiv:2602.15654, February 2026; Xianglin Yang et al.).