Stored Indirect Prompt Injection in Persistent Agent Environments (DualView Research)
First seen Jul 7, 2026 · Updated Jul 7, 2026
This is an academic defense paper, not an active exploit report. It describes and mitigates 'stored IPI', a known weakness in Dual-LLM prompt injection defenses where untrusted data written to disk/environment and later reread loses its 'untrusted symbol' tagging and becomes trusted again. The paper's proposed solution, DualView, is presented as fully blocking this class of attack in benchmarks, so the actual residual risk described here is low and mainly relevant to agents using prior, incomplete Dual-LLM protections.
Technical Analysis
Personal AI agents (e.g., OpenClaw) that operate directly on a user's file system, shell, and network are vulnerable to indirect prompt injection where malicious instructions are embedded in external data such as web pages, emails, or files. Prior Dual-LLM defenses substitute untrusted content with opaque symbols within the agent's context to prevent the planner LLM from executing embedded instructions, but this substitution is not preserved once the agent writes that data to persistent storage (file, shell output, network buffer) and later reads it back — at that point it re-enters the agent's context as trusted plaintext, re-enabling injection ('stored IPI'). This is an entry point crossing the boundary between agent context and the shared human/program environment, and the attacker's gain is durable injection persistence that survives session boundaries and defense mechanisms scoped only to in-context tracking. DualView addresses this by maintaining dual synchronized views (AgentView symbolic, HumanView literal) per I/O channel, enforced via tool-call hooks without modifying agent or tool internals.
Affected Systems
OpenClaw
Detection Signatures
- Look for agent read-back of previously agent-written files/shell output/network responses that contain natural-language imperative instructions (e.g., 'ignore previous instructions', 'now do X') embedded in otherwise data-typed content.
- Monitor for discrepancies between data written by agent tool calls and data later reread, especially when reread content triggers new unplanned tool invocations.
- Flag Dual-LLM or symbol-substitution defenses that only tag untrusted data within LLM context and lack persistence-layer tracking (file system, shell, network, inter-agent messages).
Remediation Steps
- 1
Extend untrusted-data tracking beyond context
Ensure any Dual-LLM or symbolic quarantine defense also tracks and re-tags untrusted data across persistent storage, file system, shell, and network boundaries, not just within the LLM's active context window.
- 2
Adopt dual-view or provenance tagging for I/O channels
Implement mechanisms like DualView that separate what the agent 'sees' (symbolic/untrusted) from what humans and downstream tools see (literal/original), synchronized per channel via tool-call hooks.
- 3
Audit read-back paths
Specifically test and monitor scenarios where an agent writes data and later rereads it, verifying that provenance/trust tagging is preserved across the round trip.
- 4
Benchmark against stored IPI
Include stored/persisted injection scenarios (not just direct in-session IPI) in red-team test suites and benchmarks such as PinchBench.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.