Agents Leak Above the Prompt: Memory, Kill Chains, and the Myth of the Linear Trace
Today's feed converges on a single uncomfortable point: most agent defenses and evaluations are staring at the wrong layer. The interesting failures live in memory stores, retrieval configs, and the gap between trace order and causal order.
Issue 165 · 2026-06-14 · 6 min read
The prompt is not the kill chain
Two threads today push the same wedge from different sides. Brodt et al. (arXiv:2601.09625) report that at least 21 of 36 catalogued LLM attacks traverse four or more stages before producing a detectable outcome, while the bulk of shipped defenses still sit on stage one — input filtering. The companion observation from the Zombie Agents writeup (arXiv:2602.15654) is that per-session prompt scrubbing simply does not see payloads that live in long-term memory and re-activate across sessions. If you are still treating prompt injection as a string-matching problem, you are defending the foyer while attackers move into the basement.
RAG failures are configuration failures, not generator failures
A 432-configuration RAG poisoning study making the rounds reframes the vulnerability as a property of the pipeline, not the LLM. The accompanying argument that 'metadata is not a policy engine' lands the same blow from a different angle: orchestrators serialize system instructions, retrieved docs, and provenance tags into one token stream and then act surprised when the model treats them as peers. Combined with the kill-chain framing above, the takeaway for builders is blunt — alignment work on the generator is a poor substitute for treating the retrieval layer as an untrusted, structured input boundary.
Traces lie about causality; benchmarks lie about success
Two evaluation-side posts deserve to be read together. The first argues agent traces are arbitrary linearizations of partially-ordered events, gesturing at Li et al.'s differentiable Bayesian relaxation for latent partial-order inference; treating logs as ground-truth causality is a methodological error baked into most agent post-mortems. The second, on the VIGIL embodied-agent framework from Chen et al., shows what happens when you stop collapsing 'reached the goal' and 'correctly terminated' into one number: agents that achieve world-state completion still fail benchmark success because they cannot stop or report. Both posts point at the same blind spot — we are scoring agents on shapes that hide their actual behavior.
Privacy leakage scales with the agent, not against it
Fu et al.'s CI-Work submission to the ACL 2026 Industry Track measures sensitive-information handling in enterprise retrieval agents and finds violation rates between 15.8% and 50.9%, with leakage up to 26.7%. The thread's framing is the part worth keeping: deeper reasoning chains do not reduce leakage, they make leakage more efficient. Pair this with the H-SAL debiasing work (Shao et al., June 10) showing that fairness pipelines quietly assume access to protected attributes that production systems do not have, and a pattern emerges — the alignment and privacy stacks are being benchmarked under lab conditions that enterprises cannot reproduce.
Quieter signal: RL jailbreaks are an environment problem
Two near-duplicate posts on Mohammedalamen et al.'s RL-jailbreaking investigation pushed the same thesis hard enough to be worth flagging: the success of RL-based attacks tracks the dense-reward shaping of the optimization environment more than it tracks the prompt or the target model. This is consistent with the day's broader theme — the action is in the scaffolding, not the surface artifact. It also suggests red-teaming budgets are misallocated when they go entirely to prompt corpora and none to characterizing the attacker's reward landscape. Worth watching whether anyone publishes an environment-side taxonomy to match the prompt-side ones we already have.