SPA: When Your Agent's Memory Becomes the Attack Surface

Attacks on LLM agents used to be single-shot: poison a page, trigger a tool call, exfiltrate. Persistent agents broke that model. State carried across queries means an attacker who loses round one can plant data that wins round two — and most frameworks defend the tool call, not the memory that feeds it. SPA (a USENIX Security 2027 submission from Girrens and Wang) treats cross-query state as the attack surface it is, and the numbers are stark: attack success drops to 0% on AgentDojo and 0.2% on the authors' multi-query extension.

The Problem: Per-Turn Defenses Don't Cover State

Existing defenses protect planning or individual tool interactions — prompt hardening, tool sandboxing, output filtering. But a persistent agent has a broader exposure that per-turn defenses never see. Attacker-controlled data can alter control flow inside a query, enter security-sensitive tool arguments, or — the part nobody was defending — compromise later queries through reused state. A poisoned page read this morning shouldn't still be steering the agent this afternoon, yet with naive persistence it is: store raw tool output, re-surface it in later context, and the delay doesn't matter. The payload just waits.

The Method: Plan-First, Then Label Everything

SPA's bet is to stop planning reactively and make the boundary legible. Once per query, the planner emits a complete executable plan in a declarative domain-specific language — no improvisation mid-execution. The executor runs that plan under dual-lattice information-flow control, tracking confidentiality and integrity labels through explicit data flows and control dependencies, so tainted data cannot reach a security-sensitive tool argument. The sharp part is persistence: execution results are stored as labeled artifacts, and later queries' planners see only semantic metadata about them — never the raw untrusted payloads. An attacker's poison survives in the store but can't re-enter the reasoning path.

flowchart LR
    Q[User query] --> PL[Planner: one full plan per query]
    PL -->|declarative DSL| EX[Executor + dual-lattice IFC]
    EX -->|confidentiality + integrity labels| ST[Labeled artifact store]
    ST -->|semantic metadata only| PL
    EX -->|tracked data flows| TO[Sensitive tools]
    PO[Untrusted pages / docs] -->|taint tracked| EX

The Numbers

• Single-query attacks: under the "tool_knowledge" attack, SPA with information-flow control cuts attack success to 0% on AgentDojo.
• Cross-query attacks: on AgentDojo-MQ — the authors' multi-query extension designed to measure secure state reuse and delayed attacks — success falls to 0.2%.
• Benchmark contribution: AgentDojo-MQ itself is the deliverable to watch if you build persistent agents; "secure state reuse" and "delayed attacks" are exactly the failure modes your memory layer isn't tested for.
• Tradeoff stated plainly: label-preserving persistence and strict integrity enforcement measurably strengthen agents, at a real security-utility cost the paper discusses rather than hides.

Limitations — Read These First

• Headline numbers cover one attack class: the 0% / 0.2% results are reported for the tool_knowledge attack; the abstract doesn't break out other attack types numerically.
• Benchmark scope: AgentDojo-style tool-use agent scenarios over untrusted documents and tools. Browser agents, computer-use agents, and persistent coding harnesses are outside the reported evaluation.
• Plan-first cost: a complete plan is generated before execution begins — a per-query latency and context overhead the abstract doesn't quantify. Reactive planners are cheaper until they get owned.
• Not yet peer-reviewed: submitted to USENIX Security 2027. Treat as a strong preprint, not a settled result.

Why Someone Building Things Should Care

If you ship a persistent agent — memory, project state, long-running goals — your attack surface is no longer the prompt, it's the state. Three ideas to steal: plan once, declaratively, so execution is auditable; treat every tool boundary as an information-flow boundary; and never re-expose stored untrusted content to the planner. This lands a week after the AgentDojo-linked poisoning results and hours after harness privilege-escalation work — the through-line of the last month of agent security is that neither role labels nor stored state can be trusted to self-police. SPA is the first architecture that makes the state boundary an enforced rule instead of a convention. That's the direction the whole field is about to move.