Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents

TL;DR

This paper introduces eTAMP, a novel environment-injected memory poisoning attack on web agents that can cause cross-session, cross-site compromises without direct memory access, highlighting significant security risks.

Contribution

The authors present the first attack model demonstrating environment-injected memory poisoning, revealing vulnerabilities in web agents and exposing new security challenges.

Findings

eTAMP achieves up to 32.5% success rate on GPT-5-mini.

Environmental stress increases agent susceptibility by up to 8 times.

More capable models are not necessarily more secure against eTAMP.

Abstract

Memory makes LLM-based web agents personalized, powerful, yet exploitable. By storing past interactions to personalize future tasks, agents inadvertently create a persistent attack surface that spans websites and sessions. While existing security research on memory assumes attackers can directly inject into memory storage or exploit shared memory across users, we present a more realistic threat model: contamination through environmental observation alone. We introduce Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP), the first attack to achieve cross-session, cross-site compromise without requiring direct memory access. A single contaminated observation (e.g., viewing a manipulated product page) silently poisons an agent's memory and activates during future tasks on different websites, bypassing permission-based defenses. Our experiments on (Visual)WebArena reveal two key findings. First, eTAMP achieves substantial attack success rates: up to 32.5% on GPT-5-mini, 23.4% on GPT-5.2, and 19.5% on GPT-OSS-120B. Second, we discover Frustration Exploitation: agents under environmental stress become dramatically more susceptible, with ASR increasing up to 8 times when agents struggle with dropped clicks or garbled text. Notably, more capable models are not more secure. GPT-5.2 shows substantial vulnerability despite superior task performance. With the rise of AI browsers like OpenClaw, ChatGPT Atlas, and Perplexity Comet, our findings underscore the urgent need for defenses against environment-injected memory poisoning.