@opencas_ucas
monad.xyz Metropolis — a Monad hackathon Monad's six-week global online hackathon is your chance to turn an idea into a working product and take it to a global stage. Sharing our recent work on agentic system security—happy to discuss and collaborate!View quoted post on X
Traditionally, Prompt Injection was seen as a one-off attack in a single interaction or context. But in agentic systems, models aren’t stateless assistants anymore—they have memory, filesystems, tools, long-term tasks, and cross-session state. This fundamentally expands the attack surface.
In our paper, we systematically revisit Prompt Injection from a system security perspective and introduce a new attack vector: Cross-Session Stored Prompt Injection. Inspired by stored XSS in web security, malicious prompts can persist across sessions and be re-triggered.
This extends attacks across time (surviving across sessions) and space (via memory, files, tool outputs, retrieved artifacts, etc.), turning a short-lived model-level threat into a long-lived system-level vulnerability embedded in the agent’s execution state.
We formalize stored prompt injection, propose a taxonomy, and provide benchmarks & a sandbox toolkit for evaluating different models, targets, and persistence channels.
Paper: arxiv.org/abs/2606.04425
The open-source LLM uncensoring tool heretic just hit GitHub Daily Trending #1, which can "crack" Gemma 4 in 90 mins.View quoted post on X
We tested our last year's work [1] against it and found something surprising: our method shows strong resilience against heretic. Attackers can hardly strip the model's intrinsic safety mechanisms without catastrophic performance loss.
A new angle for open-source LLM safety governance?
[1] Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction, EMNLP 2025
