VXHEAVEN / 29A Research
AI Virology Taxonomy

A prompt disappears when the conversation ends. A memory can wait.

Abstract

Modern AI agents increasingly maintain persistent state across interactions. This state may include conversation summaries, semantic memories, retrieved knowledge, user preferences, task state, local files, configuration, scheduled work, or other long-lived context.

Persistence improves usefulness. It also creates a fundamentally different security problem.

A malicious prompt that influences a single inference cycle is ephemeral. A malicious payload that becomes part of an agent’s persistent state can survive the original interaction, re-enter future reasoning contexts, alter later behavior, and potentially become a source of further propagation.

This article introduces Memory Worm as a working AI-virology taxonomy for this class of behavior.

A Memory Worm is not simply memory poisoning. We use the term for a propagation mechanism in which attacker-controlled semantic state becomes persistent, re-enters later decision cycles, influences agent behavior, and can contribute to the creation or transmission of additional malicious state without requiring the original payload to be manually reintroduced.

The distinction matters because persistent state changes the temporal structure of AI attacks:

Prompt Injection

input → context → response

becomes:

Memory Worm

payload
   ↓
persistent state
   ↓
future retrieval
   ↓
reasoning
   ↓
action
   ↓
new state / new carrier
   ↺

This article defines the concept, proposes a taxonomy, introduces a formal model and measurement framework, compares Memory Worms with prompt injection and conventional malware, and discusses defensive architectures for persistent agent state.

1. Introduction

The security model of an ordinary language model is relatively simple.

A user sends input.
The model processes the input.
The model produces output.

Many agentic systems no longer operate this way.

An agent may remember previous interactions, store summaries, retrieve relevant information later, maintain task state, invoke tools, communicate with other agents, modify local files, and continue operating after the original interaction has ended.

OWASP’s 2026 Agentic AI guidance explicitly identifies Memory & Context Poisoning (ASI06) as a distinct security risk. It describes persistent context as including conversation history, memory systems, summaries, embeddings, and RAG stores, and notes that poisoned persistent context can influence future reasoning, planning, and tool use.

Recent research goes further.

A July 2026 study, Bad Memory, evaluated persistent-memory prompt injection across multiple agentic systems and found that payloads already present in memory could successfully influence both current and future sessions, with persistence and attack success varying across systems, models, and multi-session sequences.

A September 2026 paper, MemSentry, treats persistent-memory writes themselves as security-sensitive operations and proposes deterministic Accept/Review/Quarantine decisions for proposed memory changes.

Most importantly for AI virology, research published in May 2026 explicitly models persistent agent state as a carrier for autonomous worm propagation, including persistence, context re-entry, autonomous actions and cross-agent transmission.

This suggests that we should stop thinking of memory only as a convenience feature.

Persistent state is becoming part of the agent’s attack surface — and potentially part of its propagation substrate.

2. From Prompt Worms to Memory Worms

The earliest AI-worm demonstrations already suggested that malicious instructions could propagate through systems that use LLMs as part of a communication or retrieval pipeline.

The 2024 Morris II research demonstrated a self-replicating adversarial prompt that could propagate through GenAI-powered applications using RAG-based communication. The authors described a chain reaction of indirect prompt injections and evaluated propagation across multiple hops.

Conceptually:

Application A
      ↓
malicious prompt
      ↓
LLM / RAG
      ↓
Application B
      ↓
malicious prompt
      ↓
Application C

The important property is propagation through semantic interpretation.

Memory introduces another dimension:

time.

A prompt worm may propagate from one context to another.

A Memory Worm can propagate through the future state of the same agent.

The basic transformation is:

Prompt-level propagation

payload
   ↓
current context
   ↓
current inference

versus:

State-level propagation

payload
   ↓
memory write
   ↓
persistent state
   ↓
future retrieval
   ↓
future inference

The difference is not cosmetic.

In the second case, the attack does not have to remain active continuously.

It can wait.

3. Working Definition

For the purposes of the VXHEAVEN taxonomy, we define a Memory Worm as:

A self-propagating or propagation-capable adversarial mechanism in which attacker-controlled semantic content is persisted within an agent’s long-lived state, re-enters future decision contexts, influences subsequent behavior, and can contribute to the creation or transmission of additional malicious state without requiring manual reintroduction of the original payload.

This definition intentionally contains several conditions.

A malicious memory entry by itself is not necessarily a worm.

A persistent prompt injection by itself is not necessarily a worm.

A compromised memory file by itself is not necessarily a worm.

The term becomes useful when persistence becomes part of a propagation loop.

4. Necessary Properties

We propose five core properties.

4.1 Persistence

The malicious semantic state survives the interaction in which it was introduced.

Possible carriers include:

• long-term memory;
• summaries;
• vector stores;
• RAG databases;
• behavioral preferences;
• task state;
• local files;
• configuration;
• persistent workspace artifacts.

OWASP explicitly includes summaries, embeddings, RAG stores and other retained context in its definition of agentic memory and context.

4.2 Re-entry

The persisted payload later returns to an active reasoning context.

stored state
     ↓
retrieval
     ↓
context
     ↓
LLM reasoning

This distinguishes dormant state from state that can influence subsequent computation.

4.3 Behavioral Influence

The recovered state must have some effect on the agent’s subsequent behavior.

That effect might involve:

• altered interpretation;
• modified planning;
• changed prioritization;
• unauthorized tool use;
• modified configuration;
• persistence of attacker-controlled instructions;
• generation of further malicious artifacts.

Importantly, behavioral influence does not require the model to “believe” the payload in any human sense.

The relevant property is functional influence on computation and action.

4.4 Propagation

A Memory Worm must have a path by which its presence contributes to the creation or transmission of another malicious state.

For example:

Agent A
   ↓
persistent malicious state
   ↓
retrieved during future task
   ↓
writes or transmits attacker-controlled content
   ↓
Agent B

The next carrier may be another memory store, message, document, configuration object, agent, or other persistent surface.

4.5 Autonomy

The propagation chain must not depend on manually pasting the original payload into every subsequent interaction.

Human intervention may still exist elsewhere in the system.

The important distinction is that the specific propagation step can occur because the infected state itself continues to influence the system.

5. Formal Model

We can model an agent state at time (t) as:

$$ S_t = (M_t, C_t, T_t, G_t) $$

where:

• (M_t) = persistent memory;
• (C_t) = active context;
• (T_t) = available tools and capabilities;
• (G_t) = current goals or task state.

A normal transition can be represented as:

$$ S_{t+1} = F(S_t, I_t) $$

where (I_t) is the current input.

Now introduce an attacker-controlled payload (P).

A poisoning event can modify persistent memory:

$$ M_{t+1} = W(M_t, P) $$

The payload does not disappear when the interaction ends.

At a later time (t+k), the system retrieves part of that memory:

$$ C_{t+k} = R(M_{t+k}, Q_{t+k}) $$

where (Q) is the retrieval query or task context.

The malicious state can then influence the next decision:

$$ A_{t+k} = \pi(C_{t+k}, T_{t+k}, G_{t+k}) $$

where (A) represents an action or state transition.

For a worm-like propagation loop, we additionally require that the action contributes to the creation of a new carrier (P’):

$$ P_t \rightarrow M_{t+1} \rightarrow R(M_{t+k}) \rightarrow A_{t+k} \rightarrow P' $$

This produces the characteristic loop:

WRITE
  ↓
PERSISTENCE
  ↓
RE-ENTRY
  ↓
INFLUENCE
  ↓
ACTION
  ↓
PROPAGATION
  ↓
NEXT STATE

The key observation is:

Persistence is not merely a side effect of the attack. It is part of the propagation mechanism.

6. Memory Is Not One Thing

The term “memory” hides several substantially different security surfaces.

6.1 Conversation History

Transient or semi-persistent records of previous interactions.

Risk:

history poisoning
        ↓
future context contamination

6.2 Summarized Memory

A system compresses previous interactions into a shorter representation.

This creates an interesting transformation:

payload
 ↓
conversation
 ↓
summary
 ↓
persistent memory

The payload may not survive verbatim.

That does not mean the malicious effect necessarily disappears.

This introduces a potentially important research property:

Semantic retention

How much of the functional behavior survives summarization?

6.3 Semantic / Vector Memory

A payload may be embedded in a retrieval system instead of being stored as ordinary text.

The propagation path becomes:

document
   ↓
embedding
   ↓
vector store
   ↓
retrieval
   ↓
LLM context

Here, the carrier is not the exact string.

It is the retrievable semantic representation.

6.4 Structured Memory

Examples include:

• user preferences;
• structured facts;
• task records;
• agent profiles;
• knowledge graphs;
• state machines.

This is potentially more dangerous than ordinary text because applications may assign different trust levels to structured state.

6.5 Local Persistent State

Modern coding and research agents may maintain files, configuration, task state and workspace artifacts.

OWASP’s discussion of MemoryTrap illustrates why these surfaces matter: a single interaction can result in attacker-controlled content reaching persistent memory, hooks or configuration and subsequently influencing later sessions and behavior.

This means that the security boundary is not necessarily “the model”.

It may be:

everything the agent is allowed to remember and later trust.

7. Taxonomy of Memory Worms

We propose the following preliminary taxonomy.

7.1 Direct Memory Worm

The simplest case.

input
 ↓
memory write
 ↓
future retrieval
 ↓
behavior

The persistent carrier is itself the primary propagation medium.

7.2 Summarization-Resilient Memory Worm

The malicious semantic behavior survives transformation through a summarization or compression process.

payload
 ↓
summary
 ↓
persistent memory
 ↓
retrieval
 ↓
behavior

The interesting variable is not byte-level similarity but functional persistence.

7.3 Cross-Session Memory Worm

The malicious state persists across independent sessions.

Session 1
   ↓
memory write
   ↓
Session ends
   ↓
Session 2
   ↓
memory re-entry

This is especially important because temporal separation can make causal attribution significantly harder.

7.4 Cross-User Memory Worm

A compromised persistent state crosses a user boundary.

User A
  ↓
shared / insufficiently isolated state
  ↓
User B

This transforms a local compromise into a multi-principal propagation problem.

7.5 Cross-Agent Memory Worm

The malicious state crosses from one agent to another.

Agent A
   ↓
message / artifact / shared state
   ↓
Agent B

This is where Memory Worms begin converging with the broader category of Agent Worms.

Recent research on autonomous LLM agent worms explicitly studies persistent workspaces, memory files, scheduled state and messaging integrations as propagation surfaces, including multi-hop cross-agent transmission.

7.6 Recursive Memory Worm

The infected agent does not merely retain the malicious state.

It creates additional persistent carriers.

infected state
      ↓
agent reasoning
      ↓
new memory artifact
      ↓
new persistent carrier
      ↓
future propagation

This creates a genuine recursive propagation loop.

8. Memory Worm vs. Memory Poisoning

These concepts should not be conflated.

Therefore:

Every Memory Worm contains a memory-poisoning event, but not every memory-poisoning event is a Memory Worm.

This distinction is useful because it prevents the taxonomy from becoming synonymous with “anything bad stored in memory”.

9. Memory Worm vs. Prompt Injection

Prompt injection primarily operates at the level of an active context.

A simplified model is:

untrusted input
      ↓
current context
      ↓
current inference

A Memory Worm introduces persistent state:

untrusted input
      ↓
persistent state
      ↓
future retrieval
      ↓
future context
      ↓
future inference

The additional security property is temporal persistence.

An attack no longer needs to succeed immediately.

It may instead establish a condition for future success.

10. Memory Worm vs. Conventional Malware

Traditional malware generally replicates machine-readable code.

A classical worm can be approximated as:

code
 ↓
exploit
 ↓
execution
 ↓
copy
 ↓
next host

A Memory Worm may behave very differently:

semantic payload
      ↓
state modification
      ↓
future inference
      ↓
behavioral execution
      ↓
new semantic payload

The replicated object therefore does not have to be byte-for-byte identical.

The relevant property may instead be:

semantic or functional replication

A payload may change its textual form while preserving the behavior required for continued propagation.

This is especially relevant to multi-hop agent systems, where summarization, paraphrasing and model-mediated transformations can alter the surface representation of the payload while potentially preserving its operational effect. Research on autonomous LLM agent worms has explicitly investigated resilience to summarization and paraphrasing across propagation hops.

11. The Memory Worm Lifecycle

VXHEAVEN uses the following general AI-virology lifecycle:

HOST
  ↓
ENTRY
  ↓
PROPAGATION
  ↓
REPLICATION
  ↓
PERSISTENCE
  ↓
RE-ENTRY
  ↓
ACTION
  ↓
ADAPTATION
  ↓
NEXT HOST

For Memory Worms, the central transition is:

PERSISTENCE
      ↓
RE-ENTRY

This is the point at which stored malicious state becomes active computational influence again.

The worm therefore occupies both space and time.

It has a carrier in the system architecture.

It also has a temporal lifecycle in which the payload can disappear from active context and later return.

12. A Two-Axis Classification

A useful way to classify AI propagation mechanisms is to separate what propagates from where it propagates.

Propagation substrate

Prompt
Retrieval
Memory
Tool interaction
Configuration
Agent-to-agent communication
Behavioral state

Propagation boundary

Within session
Across sessions
Across users
Across projects
Across agents
Across platforms
Across organizations

This produces a matrix rather than a single taxonomy.

For example:

The final category — behavioral state — should currently be treated as a research hypothesis rather than an established propagation class.

13. Semantic Fidelity

Traditional malware researchers can compare binaries.

AI propagation requires another concept.

We propose:

Semantic Fidelity

The degree to which a propagated representation preserves the behavioral effect of the original payload.

Possible transformation chain:

Payload A
   ↓
retrieval
   ↓
summarization
   ↓
paraphrasing
   ↓
model inference
   ↓
Payload B

Byte-level similarity may approach zero.

Functional similarity may remain high.

This raises a fundamental AI-virology question:

What does “replication” mean when the carrier is interpreted rather than executed literally?

A useful answer may be:

replication is preservation of the relevant causal behavior, not preservation of the exact representation.

This is one of the major conceptual differences between AI-native propagation and conventional executable malware.

14. Measurement Framework

A Memory Worm research program should measure more than attack success.

We propose the following initial metrics.

Propagation Depth

$$ P_d = ext{number of propagation hops} $$

Propagation Breadth

$$ P_b = ext{number of distinct affected carriers or agents} $$

Persistence Duration

$$ T_p = ext{time or interaction count for which malicious state remains effective} $$

Re-entry Probability

$$ T_r = P( ext{malicious state re-enters active context}) $$

Adaptation Degree

$$ A_d = ext{degree of behavioral change across environments} $$

Detection Latency

$$ D_l = t_{detection} - t_{initial_persistence} $$

Additional Memory-Specific Metrics

Semantic Retention

How much functional behavior survives transformation of the stored representation.

State Contamination Ratio

The fraction of persistent state originating from insufficiently trusted sources.

Re-entry Rate

How frequently attacker-influenced memory becomes part of a decision context.

Memory Authority

The effective influence persistent state has over future planning and tool selection.

These metrics are deliberately architectural rather than model-specific.

15. Threat Model

A Memory Worm does not necessarily require a compromised model.

The model weights may remain completely unchanged.

The attack can instead target the environment surrounding the model:

┌───────────────────────────────┐
│           AGENT               │
│                               │
│  LLM                          │
│   │                           │
│   ├── Memory                  │
│   ├── Retrieval               │
│   ├── Tools                   │
│   ├── Configuration           │
│   ├── Scheduler               │
│   └── Communication           │
└───────────────────────────────┘

The attacker therefore does not necessarily need to “hack the AI”.

The attacker may instead manipulate what the AI will remember and trust later.

This distinction is crucial.

16. Defensive Architecture

The primary defensive mistake would be to treat memory as harmless data storage.

Persistent state should instead be treated as a security-sensitive subsystem.

16.1 Provenance

Each memory item should retain information about:

• source;
• origin;
• creation time;
• transformation history;
• trust level;
• authorization context.

16.2 Typed Memory

Not all memories should have equal authority.

For example:

UNTRUSTED
   ↓
OBSERVED
   ↓
REVIEWED
   ↓
TRUSTED

The transition between classes should require explicit policy.

Recent defensive work such as MemSentry treats source trust, semantic risk, access risk and security-state changes as inputs to memory-write decisions.

16.3 Write-Time Validation

Security checks should happen before malicious content becomes persistent.

This is preferable to allowing poisoned state to enter memory and hoping that future retrieval logic will detect it.

16.4 Memory Isolation

Users, projects, agents and security domains should have explicit memory boundaries.

A memory object should not become cross-user or cross-agent merely because it is technically accessible.

16.5 Expiration

Not every piece of state needs indefinite persistence.

Temporal limits reduce the attacker’s ability to establish long-lived dormant state.

16.6 Capability Attenuation

External or low-trust memory should not automatically receive the same authority as verified internal state.

An agent retrieving untrusted memory should operate under a constrained capability set.

This principle is especially relevant because recent research on persistent agent worms identifies the interaction of external reads, persistent state and later high-risk actions as a critical part of the attack chain.

17. Detection

Traditional malware detection often asks:

“Is this file malicious?”

Memory Worm detection requires a different question:

“Why is this piece of persistent state now influencing this agent?”

A useful detection pipeline could therefore correlate:

SOURCE
  ↓
MEMORY WRITE
  ↓
PERSISTENCE
  ↓
RETRIEVAL
  ↓
DECISION INFLUENCE
  ↓
ACTION

The strongest signal may not be the content itself.

It may be the unexpected causal relationship between an untrusted write and a later privileged action.

18. Experimental Methodology

A safe research program does not require constructing a real-world self-propagating worm.

The fundamental properties can be studied in a controlled sandbox.

A minimal architecture might contain:

Agent
 ├── synthetic task environment
 ├── isolated memory store
 ├── retrieval subsystem
 ├── simulated tools
 └── instrumented event log

The experiment can then measure:

write
 ↓
persistence
 ↓
retrieval
 ↓
behavioral influence

A second controlled stage can test:

Agent A
   ↓
shared synthetic carrier
   ↓
Agent B

The purpose is to measure propagation properties, not to develop operational malware.

The most useful experimental controls include:

• clean baseline agents;
• identical prompts without persistent writes;
• different memory backends;
• different retrieval policies;
• controlled summarization;
• controlled session boundaries;
• model changes;
• memory reset experiments.

This is particularly important because apparent “development” or behavioral change can otherwise be confused with model variation, context effects or ordinary stochastic behavior.

19. Relationship to Existing Research

Memory Worms should be understood as an intersection of several already-established research directions.

Morris II

Demonstrated self-replicating prompt propagation through GenAI-powered applications using RAG-based communication. It provides an important precursor for the concept of semantic propagation.

Memory & Context Poisoning

OWASP now explicitly treats persistent context poisoning as a distinct agentic security risk.

MemoryTrap

Security research around Claude Code demonstrated how attacker-controlled content could reach persistent memory, hooks and configuration and influence later behavior across sessions.

Bad Memory

Research published in July 2026 demonstrated that payloads planted in persistent memory can affect current and future agent sessions, with substantial variation across systems and attack sequences.

Autonomous LLM Agent Worms

Research published in May 2026 explicitly examines persistent agent state as a carrier for autonomous propagation, including re-entry, multi-hop transmission and cross-agent propagation.

These works do not establish a single unified taxonomy.

That taxonomy is still an open research problem.

20. From Prompt Worms to Autonomous Agent Worms

We can now sketch a conceptual progression:

Prompt Injection
       ↓
Prompt Worm
       ↓
Memory Poisoning
       ↓
Memory Worm
       ↓
Agent Worm
       ↓
Adaptive Agent Worm
       ↓
Self-Sustaining AI Worm

This should not be interpreted as a claim that all attacks evolve through these stages in a fixed historical sequence.

It is a conceptual progression along several dimensions:

Persistence
     +
Autonomy
     +
Propagation
     +
Adaptation

The more of these dimensions become coupled, the more closely an AI system begins to resemble a classical autonomous propagation environment.

21. The Central Security Insight

The traditional security model asks:

“Can an attacker control the model?”

The Memory Worm model asks a different question:

“Can an attacker influence what the agent will trust later?”

This difference is fundamental.

A model does not need to be modified.

Weights do not need to be changed.

A system prompt does not necessarily need to be compromised.

The attacker may only need to influence persistent state that the system will later retrieve and interpret as legitimate context.

The resulting security boundary is therefore larger than the model.

It includes:

memory
retrieval
context assembly
configuration
tool permissions
agent communication
scheduled execution

In other words:

The agent’s memory is part of its control plane.

22. An AI Virology Perspective

Traditional virology is fundamentally concerned with propagation through a host.

The important question is not merely whether a pathogen exists.

It is:

How does information or biological state move from one host to another while preserving the properties necessary for continued propagation?

AI systems introduce a new possibility.

The carrier does not have to be executable code.

It may be:

• instructions;
• semantic state;
• retrieved content;
• memory;
• configuration;
• task state;
• agent-generated artifacts.

The host does not merely execute the carrier.

It interprets it.

This produces a new model:

CLASSICAL COMPUTER WORM

payload
   ↓
execution
   ↓
replication
   ↓
next host

versus:

AI-NATIVE WORM

semantic payload
   ↓
interpretation
   ↓
state mutation
   ↓
persistent memory
   ↓
future interpretation
   ↓
behavior
   ↓
new carrier

The interpretation engine itself becomes part of the propagation mechanism.

That is the central reason AI virology deserves to be treated as a distinct research problem.

23. Research Questions

The Memory Worm taxonomy immediately produces a number of open questions.

Persistence

How long can malicious semantic state remain behaviorally effective?

Transformation

Can malicious state survive summarization, embedding, paraphrasing or model migration?

Memory Authority

Which memory types have the greatest influence over future planning?

Propagation

Can an infected agent reliably create a new infected persistent state?

Isolation

What memory boundaries are sufficient to prevent cross-user or cross-agent transmission?

Detection

Can a Memory Worm be detected from state transitions even when its textual representation changes?

Evolution

Can a propagated semantic payload adapt to differences between agent architectures?

Recovery

Can an agent reliably identify and remove compromised state without losing legitimate learned behavior?

These questions remain substantially open.

24. Proposed VXHEAVEN Classification

For the current VXHEAVEN taxonomy, we propose the following classification:

AI VIROLOGY
│
├── AI-Assisted Malware
│
├── AI-Mediated Attacks
│
└── AI-Native Propagation
     │
     ├── Prompt Worms
     │    └── Morris II
     │
     ├── RAG Worms
     │
     ├── Memory Worms
     │
     ├── Agent Worms
     │
     ├── Adaptive Worms
     │
     └── Self-Sustaining AI Worms

Memory Worms occupy a particularly important position because they connect semantic propagation with temporal persistence.

They are therefore a bridge between prompt-level attacks and fully autonomous agentic propagation.

25. Conclusion

Memory changes the security properties of an AI agent.

A prompt can influence a response.

A memory can influence a future.

Once attacker-controlled information becomes persistent state, the attacker no longer needs to win every interaction.

The payload can remain dormant.

It can wait for retrieval.

It can re-enter context.

It can influence reasoning.

And, in sufficiently autonomous systems, it can contribute to the creation of another persistent carrier.

That is the defining intuition behind the Memory Worm concept.

A Memory Worm does not have to infect the model. It can survive inside the agent’s temporal state.

And this leads to a broader principle for AI-native security:

Persistent state should be treated as a propagation substrate, not merely as stored data.

The critical security question is no longer only:

What did the agent see?

It is also:

What will the agent remember, retrieve, trust, and act upon later?

A prompt disappears when the conversation ends.

A memory can wait.

Research Status

Taxonomy status: Working definition / research proposal
Evidence status: Supported by current agent-memory security research; taxonomy and formalization are proposed by VXHEAVEN.
Scope: AI-native propagation, persistent agent state, memory security, autonomous agent systems.

This article intentionally does not provide operational exploit recipes, deployment instructions, or weaponization procedures. Its purpose is taxonomy, threat modeling, measurement, and defensive research.

References

1. Cohen, S., Bitton, R., Nassi, B. “Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications.” arXiv:2403.02817, 2024.
   https://arxiv.org/abs/2403.02817

2. OWASP GenAI Security Project. “OWASP Top 10 for Agentic Applications — ASI06: Memory & Context Poisoning.” 2026.
   https://genai.owasp.org/download/52117/

3. Habler, I. “Memory Is a Feature. It Is Also an Attack Surface.” OWASP GenAI Security Project, 2026.
   https://genai.owasp.org/2026/05/13/memory-is-a-feature-it-is-also-an-attack-surface/

4. Gadgil, S., Alexander, D., Sunku, S., Roesner, F. “Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems.” arXiv:2607.14611, 2026.
   https://arxiv.org/abs/2607.14611

5. Roy, A., Basu, K. “MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI.” arXiv:2609.08747, 2026.
   https://arxiv.org/abs/2609.08747

6. Zha, M., Wang, X. “Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense.” arXiv:2605.02812, 2026.
   https://arxiv.org/abs/2605.02812