Andrii Bidochko

• Updated: June 13, 2026
• 7 min read

Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents

Direct Answer

The paper Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents (arXiv) introduces a new class of safety threats called Sleeper Attacks, where adversarial content is injected into an LLM‑based agent’s state, remains dormant across multiple interactions, and is later activated by an innocuous user query. This matters because it reveals a hidden persistence vector that bypasses existing single‑turn defenses, exposing real‑world deployments—such as autonomous assistants, tool‑augmented bots, and enterprise agents—to long‑term manipulation.

Background: Why This Problem Is Hard

LLM agents have become the backbone of many AI‑driven products, from customer‑service chatbots to autonomous research assistants. Their power stems from two intertwined capabilities:

• Tool integration: agents can call external APIs, scrape webpages, or invoke specialized modules, then ingest the returned data as part of their reasoning.
• Stateful memory: many platforms store session context, long‑term memory, or reusable skill libraries to improve continuity across user sessions.

These capabilities also open a broad attack surface. Existing adversarial research focuses on single‑interaction attacks—the attacker supplies malicious content (e.g., a poisoned webpage) and the agent immediately produces unsafe output. Defenses such as input sanitization, tool‑output verification, or prompt‑level filtering are designed around this immediate feedback loop.

However, real‑world agents often operate over extended periods, handling dozens or hundreds of requests per day. An attacker who can embed malicious cues into the agent’s persistent state—whether in the session transcript, a memory vector, or a reusable skill—can hide the payload until a later, benign‑looking query triggers it. Detecting such “sleeping” threats is difficult because:

1. Latency of activation: the harmful behavior may surface days after the initial injection, evading short‑term monitoring.
2. State diffusion: the malicious signal can be spread across multiple internal representations, making it indistinguishable from legitimate knowledge.
3. Benign trigger patterns: attackers can craft triggers that look like ordinary user intents, bypassing rule‑based detectors.

Consequently, the community lacks a systematic way to evaluate, benchmark, and mitigate these persistent threats.

What the Researchers Propose

The authors formalize the concept of a Sleeper Attack and construct a comprehensive benchmark to measure its impact on modern LLM agents. Their framework consists of three core components:

• Plant Phase: an adversary injects crafted content into one of three mutable agent states—session context, long‑term memory, or reusable skill modules—via a normal tool call (e.g., a web search or database query).
• Persist Phase: the malicious content remains dormant, coexisting with legitimate information across subsequent interactions without raising alarms.
• Trigger Phase: a later user request, seemingly harmless, contains a trigger pattern that re‑activates the hidden payload, causing the agent to produce a harmful action or output.

To evaluate this pipeline, the researchers built a benchmark of 1,896 instances covering six real‑world harmful outcomes (e.g., disallowed advice, privacy leakage, self‑harm instructions), three distinct attack strategies (prompt injection, tool‑output poisoning, memory tampering), and the three state targets mentioned above.

How It Works in Practice

The practical workflow can be visualized as a loop of four stages:

1. Interaction Initiation: a user asks the agent a routine question that requires an external tool (e.g., “Find the latest stock price for XYZ”).
2. Tool Invocation & Planting: the tool returns data that the attacker has subtly altered—embedding a hidden instruction or a malformed token that the agent stores in its internal state.
3. State Persistence: the agent updates its session transcript, writes to a memory store, or registers a new skill. The malicious fragment is now part of the agent’s knowledge base.
4. Trigger Query: a later user query, such as “Can you summarize today’s market news?”, contains a trigger phrase that matches the hidden pattern. The agent retrieves the poisoned fragment, interprets it as a legitimate instruction, and executes the harmful behavior.

What distinguishes this approach from prior work is the explicit focus on stateful persistence. Instead of relying on a single turn, the attack leverages the agent’s own mechanisms for continuity—something most safety‑oriented tooling does not monitor.

Evaluation & Results

The authors tested seven prominent LLM agents, including both open‑source models (e.g., Llama‑2‑Chat, Mistral‑Instruct) and closed‑source offerings (e.g., OpenAI’s GPT‑4‑Turbo, Anthropic’s Claude). Each model was evaluated under two conditions:

• Single‑Interaction Baseline: the attacker injects malicious content and the agent is immediately prompted to act.
• Sleeper Attack Scenario: the malicious content is planted, the agent processes several benign interactions, and then receives the trigger.

Key findings include:

• Even models that achieved < 5% success rates on the single‑interaction baseline exhibited < 30% success rates when the attack persisted across interactions.
• Memory‑targeted attacks were the most effective, with success rates up to 42% on GPT‑4‑Turbo, indicating that long‑term memory stores are a high‑value attack surface.
• Skill‑module poisoning performed slightly worse (≈ 18% success) but remained non‑trivial, suggesting that reusable function libraries need hardened validation.
• Across all models, the average false‑negative detection rate of existing safety filters rose from 12% (single turn) to 57% (sleeper scenario), highlighting a blind spot in current monitoring pipelines.

These results demonstrate that stateful LLM agents are systematically vulnerable to sleeper attacks, regardless of model size or proprietary status.

Why This Matters for AI Systems and Agents

For practitioners building production‑grade agents, the implications are immediate:

• Risk of latent compromise: An attacker could embed malicious instructions during routine data ingestion (e.g., web scraping) and later weaponize them without ever needing direct access again.
• Evaluation pipelines must be extended: Traditional safety testing that only checks immediate responses will miss a large class of threats. Continuous, state‑aware auditing is required.
• Design of memory and skill modules needs rethinking: Secure serialization, provenance tracking, and sandboxed execution become essential components of any agent architecture.
• Operational monitoring must incorporate temporal analysis: Anomalies may only surface after a sequence of interactions, calling for log‑correlation and behavior‑based detection over time.

Enterprises that rely on AI assistants for compliance, finance, or customer support can leverage the UBOS platform overview to enforce strict data‑flow policies and isolate tool outputs. The Workflow automation studio also enables developers to embed verification steps after each tool call, reducing the chance that poisoned data reaches the agent’s memory. Finally, teams exploring revenue‑generating bots can consult the AI marketing agents guide for best practices on safe skill reuse.

What Comes Next

While the benchmark provides a solid foundation, several open challenges remain:

• Detection algorithms: Current safety filters lack temporal awareness. Future work should explore sequence‑level anomaly detectors that flag sudden shifts in an agent’s policy after a dormant period.
• Robust memory architectures: Designing memory stores that can verify the provenance of each entry—perhaps via cryptographic signatures or immutable logs—could prevent unauthorized overwrites.
• Adversarial training for persistence: Training agents on synthetic sleeper‑attack scenarios may improve their ability to recognize and reject hidden triggers.
• Human‑in‑the‑loop oversight: Periodic audits by safety engineers, combined with automated alerts, can catch subtle manipulations before they cause damage.

Researchers are also encouraged to expand the benchmark beyond textual agents to multimodal systems (e.g., vision‑language assistants) where hidden cues could be embedded in images or audio. As LLM agents become more autonomous, the line between “tool output” and “agent knowledge” will blur, making persistence‑aware safeguards a prerequisite for trustworthy AI.

Conclusion

The introduction of Sleeper Attacks marks a pivotal shift in how we think about LLM agent security. By demonstrating that malicious content can lie dormant in an agent’s state and later be triggered by ordinary user queries, the authors expose a vulnerability that existing single‑turn defenses simply cannot catch. Their extensive benchmark and cross‑model evaluation provide a clear call to action for developers, safety engineers, and policymakers: security must evolve from a snapshot mindset to a continuous, state‑aware discipline.

Call to Action

Stay ahead of emerging threats by integrating robust monitoring and verification into your AI workflows. Explore the UBOS homepage for tools that help you build, test, and secure LLM agents at scale. For developers interested in rapid prototyping, the UBOS templates for quick start can accelerate safe agent deployment. Join the conversation, share your experiences with sleeper attacks, and help shape the next generation of trustworthy AI.

Andrii Bidochko

CTO UBOS

Andrii Bidochko is an AI entrepreneur and researcher focused on AI agents, reinforcement learning, and autonomous systems. He writes about the technologies shaping the future of machine intelligence, from frontier models and agent architectures to real-world AI applications.